Workflow Permissions around issue creation are not enforced consistently between the UI & REST API

Issue Summary

When the ability to create issues has been disabled via workflow permission for all users, one can still create a new issue via the GUI. The REST API disallows this (which feels like the correct behavior).

Steps to Reproduce

1. Edit the workflow of issue type T in project P
2. Click View Properties at the initial step e.g. Open
3. Add this property:

   Key: jira.permission.createissue.denied
   Value: true
   

1. Publish the workflow
2. Attempt to create a new issue P-1 via the GUI using issue type T in project P
3. Attempt to create another issue via the REST API.

Expected Results

No new issues can be created, as this ability has been disabled by the workflow permission.

Actual Results

A new issue can still be created via the GUI (using the "Create" button or the inline issue create functionality).

However, Issues cannot be created via the REST API or via the "clone" button in the GUI. The workflow permissions are only being ignored when creating new issues in the GUI.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available