JIRA Service Desk Customers can be assigned to issues

Summary

JIRA Service Desk Customers that don't have application access to JIRA and only have the 'Restricted portal access' flag can be assigned to issues on JIRA Software projects.

Environment

JIRA Cloud version 1000.526.2

Steps to Reproduce

1. Create a JIRA Software project
2. Create a JSD customer (with restricted portal access)
3. Create an issue on this project
4. Access the issue and click the "Assignee" field to edit it
5. Start typing the name of the JSD customer

Expected Results

This JSD customer shouldn't be displayed as a suggestion for the assignee field since it doesn't have JIRA application access, furthermore it shouldn't be assigned the issue.

Actual Results

The JSD user is presented as a suggestion for the Assignee field and can be assigned to the issue.

Notes

The permission helper says the JSD customer don't have the assignable user project permission as expected, but it can be assigned to the issue either way.

This problem also happen to Watcher list.

Workaround

No workaround at the moment.