Why does hasGlobalPermission not block access to a Forge page in the manifest?

[Amine Nait Lechguer]

I am developing a Forge app for Jira and trying to restrict access to certain pages using hasGlobalPermission in the manifest.yml.
My goal is to limit access to specific pages only to Jira administrators or some specific groups.

Here is how my manifest.yml is configured:

modules: 
  jira:globalPage:
     - key: myKey
     .....
     sections:
        - header: myHeader
        ...
        pages:
          ...
          displayConditions: 
             hasGlobalPermission: ADMINISTER
....

I have created a test user who does not have the ADMINISTER permissions.
However, this user can still access the page, even though hasGlobalPermission is supposed to restrict their visibility.

I also tested retrieving permissions for this test user via the Jira API:

const response = await api
                       .asUser()
                       .requestJira(route`/rest/api/3/mypermissions?permissions=ADMINISTER`, {
                  headers: { Accept: "application/json" }
}); 

const data = await response.json(); 
console.log("🔹 Permissions:", data);

And the result confirms that the user does not have the permission (havePermission: false).

Questions:

1. Why does hasGlobalPermission not block access and visibility to the page?

2. Is there a better waqy to achieve this restriction based on permissions or specific groups?

Thank you fo you r help

[Tuncay Senturk]

Hi @Amine Nait Lechguer 

In the Jira Forge Global Page documentation, it states, "You can only specify `pages` or `sections`, but not both." However, in your manifest, I see the pages listed under sections. Could this be the problem?

Please bear in mind that the Atlassian Developer Community is a better place to ask this sort of question as you may get more answers there.