Skip to content

Commit 38aa163

Browse files
waleedlatif1waleedlatif1
authored
fix(oauth): trim Atlassian OAuth scopes to fix CloudFront 414 (#4388)
* fix(oauth): trim Atlassian OAuth scopes to fix CloudFront 414 * fix(oauth): restore Confluence scopes whose tools are still active * fix(oauth): add JSM Forms scopes for form tools * fix(oauth): restore read:issue.vote:jira scope Jira issue retrieve tool reads fields.votes.votes and fields.votes.hasVoted from the GET /rest/api/3/issue payload, which requires the read:issue.vote:jira granular scope. Restoring to prevent vote data from being omitted in retrieve responses. * fix(oauth): drop redundant Jira granular scopes covered by classic Atlassian recommends <50 scopes per OAuth app to keep authorize URLs under URL-length limits. Drops 20 granular Jira read/write scopes that are subsumed by the classic read:jira-work / write:jira-work scopes already in the list. Existing user tokens are unaffected — Atlassian refresh keeps originally-granted scopes; the trimmed list only applies to new authorizations. Kept granular scopes: delete:* (no classic equivalent) and JSM granular scopes (separate scope family). * fix(oauth): re-add read:issue.vote:jira to match PR description Bugbot flagged that the previous classic-scope collapse dropped this granular scope while the PR description still claimed it was restored. Classic read:jira-work covers vote reads, but adding the granular explicitly keeps the description, code, and intent aligned.
1 parent add55b4 commit 38aa163

3 files changed

Lines changed: 15 additions & 45 deletions

File tree

‎apps/sim/app/api/tools/jira/issues/route.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
8282
{
8383
error: errorMessage,
8484
authRequired: true,
85-
requiredScopes: ['read:jira-work', 'read:project:jira'],
85+
requiredScopes: ['read:jira-work'],
8686
},
8787
{ status: response.status }
8888
)
@@ -202,7 +202,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
202202
{
203203
error: errorMessage,
204204
authRequired: true,
205-
requiredScopes: ['read:jira-work', 'read:project:jira'],
205+
requiredScopes: ['read:jira-work'],
206206
},
207207
{ status: response.status }
208208
)

‎apps/sim/lib/oauth/oauth.ts‎

Lines changed: 9 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -441,7 +441,6 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
441441
'read:confluence-content.all',
442442
'read:confluence-space.summary',
443443
'read:space:confluence',
444-
'read:space-details:confluence',
445444
'write:confluence-content',
446445
'write:confluence-space',
447446
'write:confluence-file',
@@ -451,7 +450,6 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
451450
'write:comment:confluence',
452451
'delete:comment:confluence',
453452
'delete:attachment:confluence',
454-
'read:content:confluence',
455453
'delete:page:confluence',
456454
'read:label:confluence',
457455
'write:label:confluence',
@@ -460,18 +458,19 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
460458
'search:confluence',
461459
'read:me',
462460
'offline_access',
463-
'read:blogpost:confluence',
464-
'write:blogpost:confluence',
465-
'delete:blogpost:confluence',
466-
'read:content.property:confluence',
467-
'write:content.property:confluence',
468461
'read:hierarchical-content:confluence',
469462
'read:content.metadata:confluence',
470463
'read:user:confluence',
464+
'read:confluence-user',
471465
'read:task:confluence',
472466
'write:task:confluence',
473467
'write:space:confluence',
474468
'delete:space:confluence',
469+
'read:blogpost:confluence',
470+
'write:blogpost:confluence',
471+
'delete:blogpost:confluence',
472+
'read:content.property:confluence',
473+
'write:content.property:confluence',
475474
'read:space.property:confluence',
476475
'write:space.property:confluence',
477476
'read:space.permission:confluence',
@@ -494,63 +493,27 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
494493
'read:jira-user',
495494
'read:jira-work',
496495
'write:jira-work',
497-
'write:issue:jira',
498-
'read:project:jira',
499-
'read:issue-type:jira',
500496
'read:me',
501497
'offline_access',
502-
'read:issue-meta:jira',
503-
'read:issue-security-level:jira',
504498
'read:issue.vote:jira',
505-
'read:issue.changelog:jira',
506-
'read:avatar:jira',
507-
'read:issue:jira',
508-
'read:status:jira',
509-
'read:user:jira',
510-
'read:field-configuration:jira',
511-
'read:issue-details:jira',
512-
'read:issue-event:jira',
513499
'delete:issue:jira',
514-
'write:comment:jira',
515-
'read:comment:jira',
516500
'delete:comment:jira',
517-
'read:attachment:jira',
518-
'write:attachment:jira',
519501
'delete:attachment:jira',
520-
'write:issue-worklog:jira',
521-
'read:issue-worklog:jira',
522502
'delete:issue-worklog:jira',
523-
'write:issue-link:jira',
524503
'delete:issue-link:jira',
525-
'manage:jira-webhook',
526-
'read:webhook:jira',
527-
'write:webhook:jira',
528-
'delete:webhook:jira',
529-
'read:issue.property:jira',
530-
'read:comment.property:jira',
531-
'read:jql:jira',
532-
'read:field:jira',
533504
// Jira Service Management scopes
534505
'read:servicedesk:jira-service-management',
535506
'read:requesttype:jira-service-management',
536507
'read:request:jira-service-management',
537508
'write:request:jira-service-management',
538509
'read:request.comment:jira-service-management',
539510
'write:request.comment:jira-service-management',
540-
'read:customer:jira-service-management',
541-
'write:customer:jira-service-management',
542511
'read:servicedesk.customer:jira-service-management',
543512
'write:servicedesk.customer:jira-service-management',
544513
'read:organization:jira-service-management',
545514
'write:organization:jira-service-management',
546515
'read:servicedesk.organization:jira-service-management',
547516
'write:servicedesk.organization:jira-service-management',
548-
'read:organization.user:jira-service-management',
549-
'write:organization.user:jira-service-management',
550-
'read:organization.property:jira-service-management',
551-
'write:organization.property:jira-service-management',
552-
'read:organization.profile:jira-service-management',
553-
'write:organization.profile:jira-service-management',
554517
'read:queue:jira-service-management',
555518
'read:request.sla:jira-service-management',
556519
'read:request.status:jira-service-management',
@@ -559,6 +522,9 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
559522
'write:request.participant:jira-service-management',
560523
'read:request.approval:jira-service-management',
561524
'write:request.approval:jira-service-management',
525+
'read:form:jira-service-management',
526+
'write:form:jira-service-management',
527+
'delete:form:jira-service-management',
562528
],
563529
},
564530
},

‎apps/sim/lib/oauth/utils.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
7070
'read:hierarchical-content:confluence': 'View page hierarchy (children and ancestors)',
7171
'read:content.metadata:confluence': 'View content metadata (required for ancestors)',
7272
'read:user:confluence': 'View Confluence user profiles',
73+
'read:confluence-user': 'View Confluence user profiles (v1 API)',
7374
'read:task:confluence': 'View Confluence inline tasks',
7475
'write:task:confluence': 'Update Confluence inline tasks',
7576
'delete:blogpost:confluence': 'Delete Confluence blog posts',
@@ -200,6 +201,9 @@ export const SCOPE_DESCRIPTIONS: Record<string, string> = {
200201
'Add and remove participants from customer requests',
201202
'read:request.approval:jira-service-management': 'View approvals on customer requests',
202203
'write:request.approval:jira-service-management': 'Approve or decline customer requests',
204+
'read:form:jira-service-management': 'View JSM forms and templates',
205+
'write:form:jira-service-management': 'Attach, save, and submit JSM forms',
206+
'delete:form:jira-service-management': 'Delete JSM forms',
203207

204208
// Microsoft scopes
205209
'User.Read': 'Read Microsoft user',

0 commit comments

Comments
 (0)