feat: Jira checks follow the design's rows, copy and states

Merged
EV
4d ago
+955-230

Description

Seventh backend PR for the connector checks redesign, stacked on #16183. Jira's checks follow the design's rows, copy and states, using the framework from the earlier PRs.

Rows and copy

  • Names:

    • "Sign in to Jira"
    • "List projects"
    • "Find selected project"
    • "Run JQL query"
    • "Sample issues"
    • "Read permission schemes"
    • "Map project access"
    • "Read project roles"
    • "Read user emails"
    • "List groups"
    • "Read group members"
    • "Read member emails"

    The token-type variants and the two group-listing steps share rows, so the 14 checks make the design's 12 rows.

  • Failures give the design's line and description. The second line says what the token type needs: "Required scope: read:jira-work" for a scoped token, the Jira permission otherwise. message keeps today's text, for Error Details.

  • Passing checks give the value they found:

    • "Signed in as {name}";
    • "{n} projects visible";
    • "Found project {name}";
    • "Read an issue from {project}";
    • "{n} Browse grants in {project}";
    • "All {n} grants map to users";
    • "Read {role}: {n} members";
    • "{k} of {n} users show an email", with a caveat for the rest;
    • "All {n} groups listed";
    • "Read {n} members in {k} groups".

States

OutcomeBeforeNow
JQL query or project scope with no issuePassed with an advisoryFailed: "Query matches no issues", "No issues in the selected scope" (the design's rule from #16183)
Public project, group grants, no role grantsPassedSkipped, nothing to check: "{project} is open to all users", "Access comes through groups", "No role grants to test"
Empty groups, groups without user membersPassed with an advisoryIncomplete (inconclusive)
Partial samplesIncomplete (unexpected)Incomplete (inconclusive), no stack trace
Group listing without a totalPassedIncomplete: "Jira did not report a group total"

Fixes from the design's review

  • Missing email. A credential without an email is blamed only when Jira refuses the sign-in (401, 403, 404). A rate limit or a server error no longer reads as "Jira Cloud needs the email".
  • Cloud ID. The scoped sign-in blames the cloud ID only when tenant_info holds none: the gateway now raises JiraCloudIdError for that case. Other bad JSON reads as "Site did not answer like Jira".
  • Punctuation. Mapped messages no longer double their full stops ("…docs.. The scoped API token…", "…docs. (HTTP 403).").

Not in this PR:

  • The design's request timeout for Jira calls. The client is shared with indexing, so it belongs in its own change.
  • The partial Find. Jira takes one project key, so it lands with GitHub repos.

How Has This Been Tested?

  • New unit tests (test_jira_check_row_text.py):
    • the values;
    • the missing-email rule for 401 versus 429/500;
    • one full stop and the scoped-token line;
    • the 12 merged rows.
  • Existing Jira tests updated to the new states, plus a test that bad JSON no longer blames the cloud ID.
  • Connector and EE unit tests: 4293 passed. The 93 capability-check external dependency tests pass on a scratch DB. ty is clean.
  • No local Jira credentials, so no live run.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.
  • [Optional] Override Linear Check

🤖 Generated with Claude Code

Summary by cubic

Brings Jira's connector checks in line with the design's rows, copy, and states from the checks redesign. The 14 checks now present as the design's 12 rows, as the token-type variants and the two group-listing steps share rows.

Rows and copy

  • Checks use the design's names, and passing checks report the value found ("Signed in as {name}", "{n} projects visible", "{k} of {n} users show an email", with a caveat for the rest).
  • Failures say what the token type needs: "Required scope: read:jira-work" for scoped tokens, the Jira permission otherwise.

States and fixes

  • Empty JQL queries and scopes now fail the first check that reads them instead of passing with an advisory.
  • Public projects and group grants are skipped; a project without role grants is skipped by the roles check but its direct user grants are still checked; empty or partial samples are incomplete; a group listing without a total is incomplete.
  • The group member row counts only the groups whose page Onyx read.
  • A missing email is blamed only when Jira refuses the sign-in (401/403/404), the cloud ID only when tenant_info returns none, and mapped messages no longer double their full stops.

Summary by CodeRabbit

  • Bug Fixes
    • Jira connection checks distinguish authentication failures, inaccessible resources, invalid responses, and missing site details.
    • Empty indexing scopes no longer pass as successful checks. Dependent checks are marked inconclusive or skipped when there is nothing to evaluate.
    • Rate-limit and server errors no longer incorrectly indicate a missing email address.
  • Improved Diagnostics
    • Checks summarize visible projects, query results, issue reads, and group membership.
    • Permission and group checks clarify sample completeness and when email visibility is limited.