Skip to content

feat(jira): Add a Forge endpoint for the Jira configure link - #131114

Open
roggenkemper wants to merge 4 commits into
masterfrom
roggenkemper/feat/jira-forge-configure-link
Open

roggenkemper wants to merge 4 commits into
masterfrom
roggenkemper/feat/jira-forge-configure-link

Conversation

@roggenkemper

Copy link
Copy Markdown
Member

Adds POST /extensions/jira/forge/configure-link/, which the Forge config page calls to get the link that connects a Jira site to a Sentry org. It's the Forge equivalent of the link the Connect config page renders (JiraSentryInstallationView), and it reuses the same signed link and install pipeline.

The endpoint:

  • verifies the Forge invocation token and requires a user in session;
  • checks that the user is a Jira admin, using their own Forge user token against GET /rest/api/3/mypermissions?permissions=ADMINISTER (checking another user's permissions as the app needs the app itself to be an admin);
  • only returns a link for a Forge-only integration keyed by the site's cloud ID whose stored installation ID matches the caller.

Atlassian doesn't document that its admin pages restrict who can open them, so the admin check is the guard. The page's module key isn't checked, since what a UI invocation's key holds isn't documented and the admin check already decides who can link.

Sites migrated from Connect keep using the Connect config page until they're keyed by cloud ID.

roggenkemper and others added 4 commits November 13, 2026 10:07
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The config page's caller is checked with their own Forge user token against
Jira's mypermissions API, since checking another user's permissions as the app
would need the app itself to be a Jira admin. Also returns 503 when Forge's
signing keys can't be fetched, and matches the token helpers to the issue-events
branch.
…module key

What a UI invocation's module key holds isn't documented, and the admin check
already decides who can link the site.
@github-actions github-actions Bot added Scope: Frontend Automatically applied to PRs that change frontend components Scope: Backend Automatically applied to PRs that change backend components labels Nov 13, 2026
@github-actions

Copy link
Copy Markdown
Contributor

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

@roggenkemper
roggenkemper marked this pull request as ready for review November 13, 2026 20:32
@roggenkemper
roggenkemper requested review from a team as code owners November 13, 2026 20:32

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components Scope: Frontend Automatically applied to PRs that change frontend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants