Skip to main content

Broader Jira app permissions than needed

Feature Request

From Jira, I see the app has these permissions:

Locu can perform the following actions:

  • View user information in Jira that the user has access to, including usernames, email addresses, and avatars.

  • Fetch, register, refresh, and delete dynamically declared Jira webhooks.

  • Read Jira project and issue data, search for issues, and objects associated with issues like attachments and worklogs.

  • Create and edit issues in Jira, post comments as the user, create worklogs, and delete issues.

I suppose Jira webhooks are needed for real-time sync from Jira to Locu, that’s okay.

But I don’t get why can it:

  • create issues - i don’t see this option inside Locu

  • edit issues - i cannot edit the Jira task from Locu

  • post comments - i cannot post comments

  • create worklogs - i don’t see the option

  • delete issues - i cannot delete

Every one of these options I want to be able to disable them IF they are implemented. And if they’re not implemented, the app shouldn’t have those permissions at all. I was really hesitant allowing this app to be connected to Jira. Please this is really important for me and possibly for your other users.

Posted by Ivan Harašta ·
Status: Completed2 comments

Log in to comment and vote

Comments2

  • Locu

    Team•

    Jan 22

    Thanks for flagging this, Ivan.


    The broad write permissions you saw (create issues, edit issues, post comments, create worklogs, delete issues) all come from a single classic Atlassian scope called write:jira-work - it bundles everything together. We added it for some features we're working on (creating Jira issues from Locu tasks and automatic status updates), but you're right, it shouldn't be there until we actually ship them.

    We're removing that scope for now. When we add write features in the future, we'll use Atlassian's granular scopes instead - so if we only need to create issues, we'll only request that specific permission, not the whole bundle.


    If you want the reduced permissions right away, just disconnect and reconnect Jira in Preferences → Integrations → Jira. We’ve already merged the fix.

    Thanks for the nudge and let me know if anything else comes up.

    • Ivan Harašta

      •

      Jan 22

      Wow, that was fast. Thank you for the fix.