Why PocketQuery Macro is available to all users??

[Pranjal Shukla]

PocketQuery macro should not be available to all the users and should only be visible to Site Administrators or to a group of users defined in PocketQuery configuration.

Mostly people write queries to generate site stats or instance stats. A normal user is not concerned with that data hence it should be hidden from him.

[Felix Grund (Scandio)]

Hi Pranjal,

Thank you for question! Few clarifications...

"Mostly people write queries to generate site stats or instance stats." – how do you conclude that people use PocketQuery mostly for this purpose? This is only one of a very large set of possibilities you could do with it. Maybe you mean "in your Confluence, mostly people..."?

"A normal user is not concerned with that data hence it should be hidden from him." – what data do you mean? Basically, you should use page permissions if you want to limit view access to a PQ result. The PQ result is always in a page or blogpost, so you can use the default Confluence permissions for these entities.

Besides that, the Confluence administrator can also limit queries to specific spaces in the admin configuration of the query. This will additionally make it impossible to embedd the PQ macro for this query by page editors in other spaces. But if you want group permissions, you should definitely use the default Confluence page permissions to enable/disable people from viewing PQ data.

Regards, Felix (Scandio)

[Pranjal Shukla]

You are right, site stats is one of the possibilities. With normal user i mean any content creator who need not necessarily need to write SQL queries to generate site stats. It would be good that the macro is not at all visible to users when they dive in macro browser and should be visible to set of people either explicitly specified or part of a group.

[Felix Grund (Scandio)]

It is default Confluence that all macros are visible to all users. There is no permission on a macro per se, only to spaces, pages and other ContentEntityObjects. That means if you develop a Confluence macro, it will be immediately visible to all user who can create content. There are workarounds of course, but these wouldn't really apply to the patterns behind Confluence. That said, I still don't really understand the matter here. You say: "With normal user i mean any content creator who need not necessarily need to write SQL queries to generate site stats." -- yes, any content creator can select the PocketQuery macro in general. But the SQL queries are still totally hidden to him and only editable by Confluence administrators. And if these "normal users" should not be able to edit the query parameters (i.e. the macro), they should not have edit permissions to the page.

[Pranjal Shukla]

Felix, You said, "It is default Confluence that all macros are visible to all users.". This is not true. When you write your custom macro by visiting the admin section, there you get to choose whether this is an Admin only macro. I have written one macro and that is only visible to system administrators. However, you are right, generating site stats is one of the numerable possibilities. You can do lot more.

[Felix Grund (Scandio)]

Hi Pranjal, You are talking about user macros: https://confluence.atlassian.com/doc/writing-user-macros-4485.html I'm talking about a developed macro module in a Confluence plugin (like PocketQuery): https://developer.atlassian.com/confdev/confluence-plugin-guide/confluence-plugin-module-types/macro-module Two very different things ;)

[Nic Brough -Adaptavist-]

What group(s) have you set up in the PocketQuery configuration?  Where else do you use those groups?

[Pranjal Shukla]

I don't see an option to set groups in the Configuration. That's what I've been looking for.