High Issue Summary
Some users are not able to search for objects with attribute type Object due to IQLValidationException: No matching attribute for AQL clause ()
This is reproducible on Data Center: yes
Steps to Reproduce
- On a JSM instance with version below 4.20.25, prepare a schema with a few object types.
- In one of the object types, create an attribute type Object to reference it to another object type.
- Insert an AQL to filter the objects for this attribute.
- Create objects accordingly and make sure objects are being filtered properly.
- Add a non-admin user to the Object Schema Developer role, and leave all other Object type level roles unassigned.
- Log in as this user, edit an object, and edit the attribute with the type of Object. This user should be able to search for an object and update the attribute value successfully.
- Upgrade this instance to >=4.20.25.
- Copy the schema and leave it as it is.
- Repeat step 6 on the original schema.
- Delete the cloned schema.
- Repeat step 6 again.
Expected Results
Without any intentional changes, users who used to be able to edit objects can still edit the same objects after upgrade
Actual Results
After upgrade, some users face issue when editing some objects/object attributes. The below exception is thrown in the atlassian-jira.log file.
2023-10-04 07:05:24,634+0000 http-nio-8080-exec-5 url: /jira/rest/insight/1.0/objecttype/104/objects; user: testuser INFO testuser 425x1184x1 wveuqs 185.53.145.95,172.50.0.1 /rest/insight/1.0/objecttype/104/objects [c.r.j.p.i.services.util.ServiceUtil] InsightException:IQLValidationException: No matching attribute for AQL clause ("Server" = ad-1234)
com.riadalabs.jira.plugins.insight.common.exception.IQLValidationException: IQLValidationException: No matching attribute for AQL clause ("Server" = ad-1234)
Other symptoms are
- A pop-up screen that says
The Jira server was contacted but has returned an error response. We are unsure of the result of this operation.
- The attribute which should allow users to search for objects and select it as value doesn't suggest any objects
- HTTP status 400 is returned with an error "No matching attribute for AQL clause" in the response
By enabling debug for com.riadalabs.jira.plugins.insight.services, we'll find that the permission of the affected user is being checked for an irrelevant object type (which is in a different schema and this user shouldn't have permission to).
2023-10-04 07:05:24,634+0000 http-nio-8080-exec-5 url: /jira/rest/insight/1.0/objecttype/104/objects; user: testuser DEBUG testuser 425x1184x1 wveuqs 185.53.145.95,172.50.0.1 /rest/insight/1.0/objecttype/104/objects [c.r.j.p.i.services.permission.InsightPermissionServiceImpl] hasInsightPermission (InsightUser{key=JIRAUSER11102}, 5, 271)
Workaround
If possible, grant the affected users Object Schema Developers or Object Type Developers role in the copied schema(s)
