[JIRA] (JENKINS-59662) Pipeline input step should not render approval pop-up if logged-in user is not declared as submitter

21 views
Skip to first unread message

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 12:41:03 PM10/4/19
to jenkinsc...@googlegroups.com
Benjamin Muschko created an issue
 
Jenkins / Improvement JENKINS-59662
Pipeline input step should not render approval pop-up if logged-in user is not declared as submitter
Issue Type: Improvement Improvement
Assignee: Unassigned
Components: core, pipeline
Created: 2019-10-04 16:40
Priority: Minor Minor
Reporter: Benjamin Muschko

The submitter parameter of the input step controls which user is allowed to submit a manual step.

Let's say you have the following definition:

```
input(message: message, submitter: 'john,mary,jack')
```

If I am logged in as ben I can still click the "Proceed" button. The pipeline will then tell me that I am not allowed to approve the operation. From a user's perspective, this is misleading and confusing. The approval pop-up shouldn't even be rendered if I am not allowed to click it.

In a declarative pipeline, I believe you can work around this by using the following code:

```
when

{ beforeAgent() }

```

There a two issues with this approach:

1. Defining a manual step that uses an agent will cause the executor to be blocked which you likely will never want to do. This is a related issue and should be addressed separately.
2. How do you achieve this in a scripted pipeline? As far as I can tell, there's no way to prevent the pop-up from being rendered.
Add Comment Add Comment
 
This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)
Atlassian logo

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 12:42:02 PM10/4/19
to jenkinsc...@googlegroups.com
Benjamin Muschko updated an issue
Change By: Benjamin Muschko
The {{submitter}} parameter of the [input step|https://jenkins.io/doc/pipeline/steps/pipeline-input-step/] controls which user is allowed to submit a manual step.


Let's say you have the following definition:

```
 {{ input(message: message, submitter: 'john,mary,jack') }}
```

If I am logged in as {{ben}} I can still click the "Proceed" button. The pipeline will then tell me that I am not allowed to approve the operation. From a user's perspective, this is misleading and confusing. The approval pop-up shouldn't even be rendered if I am not allowed to click it.

In a declarative pipeline, I believe you can work around this by using the following code:

 ```
 {{ when {
    beforeAgent()
} }}
```

There a two issues with this approach:

1. Defining a manual step that uses an agent will cause the executor to be blocked which you likely will never want to do. This is a related issue and should be addressed separately.
2. How do you achieve this in a scripted pipeline? As far as I can tell, there's no way to prevent the pop-up from being rendered.

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 12:42:02 PM10/4/19
to jenkinsc...@googlegroups.com

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 12:43:03 PM10/4/19
to jenkinsc...@googlegroups.com

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 12:43:03 PM10/4/19
to jenkinsc...@googlegroups.com

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 12:44:02 PM10/4/19
to jenkinsc...@googlegroups.com

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 12:44:02 PM10/4/19
to jenkinsc...@googlegroups.com

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 12:52:01 PM10/4/19
to jenkinsc...@googlegroups.com
Benjamin Muschko updated an issue
The {{submitter}} parameter of the [input step|https://jenkins.io/doc/pipeline/steps/pipeline-input-step/] controls which user is allowed to submit a manual step.

Let's say you have the following definition:

{{input(message: message 'Do you want to approve?' , submitter: 'john,mary,jack')}}


If I am logged in as {{ben}} I can still click the "Proceed" button. The pipeline will then tell me that I am not allowed to approve the operation. From a user's perspective, this is misleading and confusing. The approval pop-up shouldn't even be rendered if I am not allowed to click it.

In a declarative pipeline, I believe you can work around this by using the following code:

when { beforeAgent() }

There a two issues with this approach:

1. Defining a manual step that uses an agent will cause the executor to be blocked which you likely will never want to do. This is a related issue and should be addressed separately.
2. How do you achieve this in a scripted pipeline? As far as I can tell, there's no way to prevent the pop-up from being rendered.

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 12:53:02 PM10/4/19
to jenkinsc...@googlegroups.com
Benjamin Muschko updated an issue
The {{submitter}} parameter of the [input step|https://jenkins.io/doc/pipeline/steps/pipeline-input-step/] controls which user is allowed to submit a manual step.

Let's say you have the following definition:

{{input(message: 'Do you want to approve?', submitter: 'john,mary,jack')}}


If I am logged in as {{ben}} I can still click the "Proceed" button. The pipeline will then tell me that I am not allowed to approve the operation. From a user's perspective, this is misleading and confusing. The approval pop-up shouldn't even be rendered if I am not allowed to click it.

In a declarative pipeline, I believe you can work around this by using the following code:

when { beforeAgent() }

There a two issues with this approach:

1. Defining a manual step that uses an agent will cause the executor to be blocked which you likely will never want to do. This is a related issue and should be addressed separately.
2. How do you achieve this in a scripted pipeline? As far as I can tell, there's no way to prevent the pop-up from being rendered based on the currently logged-in user .

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 1:15:02 PM10/4/19
to jenkinsc...@googlegroups.com
Benjamin Muschko updated an issue
The {{submitter}} parameter of the [input step|https://jenkins.io/doc/pipeline/steps/pipeline-input-step/] controls which user is allowed to submit a manual step.

Let's say you have the following definition:

{{input(message: 'Do you want to approve?', submitter: 'john,mary,jack')}}

If I am logged in as {{ben}} I can still click the "Proceed" button. The pipeline will then tell me that I am not allowed to approve the operation. From a user's perspective, this is misleading and confusing. The approval pop-up shouldn't even be rendered if I am not allowed to click it.

In a declarative pipeline, I believe you can work around this by using the following code:

when { beforeAgent() }

There a two issues with this approach:

1. Defining a manual step that uses an agent will cause the executor to be blocked which you likely will never want to do. This is a related issue and should be addressed separately. I opened for [JENKINS-59663|https://issues.jenkins-ci.org/browse/JENKINS-59663] it.
2. How do you achieve this in a scripted pipeline? As far as I can tell, there's no way to prevent the pop-up from being rendered based on the currently logged-in user.

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 1:16:02 PM10/4/19
to jenkinsc...@googlegroups.com
Benjamin Muschko updated an issue
The {{submitter}} parameter of the [input step|https://jenkins.io/doc/pipeline/steps/pipeline-input-step/] controls which user is allowed to submit a manual step.

Let's say you have the following definition:

{ { code}
input(message: 'Do you want to approve?', submitter: 'john,mary,jack')

{code } }

If I am logged in as {{ben}} I can still click the "Proceed" button. The pipeline will then tell me that I am not allowed to approve the operation. From a user's perspective, this is misleading and confusing. The approval pop-up shouldn't even be rendered if I am not allowed to click it.

In a declarative pipeline, I believe you can work around this by using the following code:

{code}
when {
beforeAgent()
}
{code}


There a two issues with this approach:

1. Defining a manual step that uses an agent will cause the executor to be blocked which you likely will never want to do. This is a related issue and should be addressed separately. I opened for [JENKINS-59663|https://issues.jenkins-ci.org/browse/JENKINS-59663] it.
2. How do you achieve this in a scripted pipeline? As far as I can tell, there's no way to prevent the pop-up from being rendered based on the currently logged-in user.

benjamin.muschko@gmail.com (JIRA)

unread,
Oct 4, 2019, 1:16:02 PM10/4/19
to jenkinsc...@googlegroups.com
Benjamin Muschko updated an issue
The {{submitter}} parameter of the [input step|https://jenkins.io/doc/pipeline/steps/pipeline-input-step/] controls which user is allowed to submit a manual step.

Let's say you have the following definition:

{{input(message: 'Do you want to approve?', submitter: 'john,mary,jack')}}


If I am logged in as {{ben}} I can still click the "Proceed" button. The pipeline will then tell me that I am not allowed to approve the operation. From a user's perspective, this is misleading and confusing. The approval pop-up shouldn't even be rendered if I am not allowed to click it.

In a declarative pipeline, I believe you can work around this by using the following code:

{code}
 when { beforeAgent() }
 {code}

There a two issues with this approach:

1. Defining a manual step that uses an agent will cause the executor to be blocked which you likely will never want to do. This is a related issue and should be addressed separately. I opened for [JENKINS-59663|https://issues.jenkins-ci.org/browse/JENKINS-59663] it.
2. How do you achieve this in a scripted pipeline? As far as I can tell, there's no way to prevent the pop-up from being rendered based on the currently logged-in user.
Reply all
Reply to author
Forward
0 new messages