Tempo "View Team Worklogs" option affects other teams

[Matthias Kannenberg]

If I have "View team worklogs" permissions in one team I can see the worklogs of my team members from projects and teams outside of the team's scope in tempo reports and account timesheets.

This is on Jira 8.20 Data Center.

Example:

Lets say I have the Jira projects Alpha and Beta. Both also have dedicated Tempo Teams and Tempo accounts. Lets further say I have 3 people: A, B and C.

• Project/Team Alpha
  • A is part of the Alpha team and has "View team worklogs" Tempo team permission as well as "View all worklogs" Jira project permission
  • B is part of the Alpha team but has no elevated permission (only sees their worklogs)
• Project/Team Beta
  • A, B and C are part of the Beta team and project but do not have "View team worklogs" or "View all worklogs" permissions

Expected Results:

• A can see B's worklogs from Alpha in the Tempo Team Timesheet, in reports and Alpha's account timesheet
• A can not see B's worklogs from Beta in reports and Beta's account timesheet
• A can not see any of C's worklogs in tempo reports or account timesheets

Actual Result:

• A can see B's worklogs from both Alpha and Beta in reports and Beta's account timesheet
• A can not see C's worklogs from Beta in reports or Beta's account timesheet
• In the collaborators overview on each issue in the Beta project A can see themselves and B, but not C

In my oppinion this does not seem to be intended behaviour and settings in one team should not affect anything outside of this teams scope (in this case any worklogs from projects not linked to the team).

My uneducated guess would be that Tempo allows me to see another persons work logs if I share a team with them and have "View team worklogs" permission and as soon as it find's such a connection does not check further for "View all worklogs" project level permissions.

[Susan Wu]

In Tempo, the intended behaviour of view worklogs permissions are as the following:

"View team worklogs" - user A will see all the worklogs of the team members regardless of which projects these team members have worked on. User will not see issue details if he/she does not have correct project permissions.

"View all worklogs" - user A will see all the worklogs of the project regardless of which teams have worked on. User does not need to be in any teams to view these worklogs.

Based on these condition and apply with your case above:

User A has "view team worklogs" for Team Alpha and "View all worklogs" for project Alpha, then User A should be able to see all the worklogs of project Alpha because of "view all worklogs" project permissions, regardless if user A has "view team worklogs" of Team Alpha.

User A can only view user B's worklogs in project Beta, but not of user C, because user A has "view team worklogs" permission in Team Alpha and has no permissions in Team Beta.

I hope this clarifies the difference between team and project permissions in Tempo.

[Matthias Kannenberg]

I understand how this is currently implemented and behaving, so I think my question is more of a "is this actually intended behaviour"?

For data protection/compliance reasons we want don't want to give users the ability to see the summary of what people are working on in projects that they do not have some kind of management role (Scrum Master, Product Owner) and do not need that information. If this is actually intended behaviour then I don't see how we can implement such a need-to-know policy.

We first noticed this behaviour because we were doing internal trainings for our Scrum Masters, putting them all in a Sandbox Project and giving them full access to Tempo team and account management, but then noticed that they are now able to see all the work that their training peers are doing, which was very much not intended.

Now we are looking at how what we want to do can be achived without using the teams feature.

Accounts would be nice but permission management in accounts is a problem because there is no dedicated view permission for multiple users and groups.

Using the report feature and giving every team a dedicated report (which counts against the "View all worklogs" project permission as far as I understand) would kind of work but we can't share saved reports (outside sharing custo URLs) to make this intuitive.

If the way it is now is really intended behaviour then I would appreciate some pointers how one could do a need-to-know approach to people being able to view the timesheets of other people.

[Susan Wu]

Tempo has another project permission - view issue hours that grants project users to only view logged hours, but not the worklog details. These users should not be part of Tempo Teams. Even if they are in a Team, they should not be a team lead or have view worklogs permission to view others worklogs. Is this what you are looking for?

[Matthias Kannenberg]

That (and the Administer Projects permission I just found through your link) sound perfect for what we want to do, but these seem to only be available in Tempo Cloud and not for our Data Center version, is this correct?

I could not find it here: https://tempo-io.atlassian.net/wiki/spaces/THC/pages/437519635/Project+Permissions+-+Tempo+Server

[Susan Wu]

Yes, this feature - view issue hours is only available on Cloud. Sorry I forgot you are using Server/Data Center.

On server/DC, without view worklog team permission or view all worklogs project permission, you will not be able to see others' logged hours in the Tempo reports. You can only see the total hours in Jira issue view (in the side panel) without seeing the collaborators.

[Matthias Kannenberg]

Sorry, I think I'm not understanding your reply or something.

My problem is that if I have "View team worklogs" permission in my team I can see their worklogs in Tempo Reports, even if they also work in other teams. This in my opionion violates a need-to-know / segragation of duty approach because I can now see what the other team members are doing their whole day (given I have at least view rights on the projects) instead of only being able to see what my team member are doing in the project I am responsible for.

Also, fyi: If I have neither "view team worklogs" team permission nor "view all worklogs" project permission I'm still able to see collaborators on the actual Jira tickets. I think this is what the "view issue hours" cloud permission that you mentioned would limit if we had in on DC.

[Susan Wu]

If you have the browse project permission for a project and one of your team members logged time against it for a different team, you, as team lead, will be able to see these worklogs even if it's not for your team.

I can see your point for need-to-know on the team members' worklogs. This is currently not possible to achieve with Team permissions, because Tempo worklogs are linked directly to users and are not identifiable by Teams.

I have put in an idea to add "view issue hours" feature on Server/DC, and another idea to have "worklogs identified by Teams". If you think this will meet your business requirements, please feel free to vote on them.

Regarding the collaborators, if you don't have those 2 worklogs permissions and still be able to view collaborators in Jira issue view, this is an unintended behaviour. Can you please open a support ticket for further investigation?

[Leonid Klimovich]

Hi Susan Wu!

We need to give a permission to Tempo Team Lead to see all the worklogs of the team members regardless of which projects these team members have worked on (even when the Lead has no access to the project). In accordance to your description that is "View team worklogs" permission. 

Where I can find it? We have JIRA Cloud&Tempo.

Thanks in advance!

[Susan Wu]

Hi @Leonid Klimovich ,

Without Browse Project permission on the projects, you will only see the team member's worklog hours, but not the worklog details. Of course, this only works if team leads are just approving the total hours worked per week/month, but they don't need to know the details on what has been done by each team member.

If the team leads need to see the worklog details, they will need to have Browse Project permission for all the projects, but they don't need to have view all worklogs permission in the projects. This will allow team leads to view only the worklogs of their team members.

For example, Scott/Rick/Daniel are Tempo Team leads and they can only see worklogs of the own team members, if they don't have view all worklogs permissions in the projects. In Tempo, if you cannot view the worklogs, you will not be able to edit/manage them.

BR,

Susan Wu

Tempo Product Expert