1

We are having several issues using the LBAPI to scope down from the portfolio items in our workspace. Since many teams contribute to a single project, and a user trying to pull metrics on these projects might not always have view access to all the contributing teams, we are faced with one of two options:

  • Return the 403 error from the Rally servers to the user, giving them no useful information with regards to the requested metrics.
  • Pass an array of "visible" teams to the LBAPI which will only return work items from teams which I have view access to.

So, the logical process would be to query with no team filter at first, and in the event that a 403 is encountered, figure out which teams I have view access to and only query for those teams. I don't necessarily mind writing the code for this; it's just that it seems like something that could easily be returned with a single API call. Ideally, in the event that a user does not have view access to any team(s), an array of those team's Object IDs would be returned with the error so that the user knew which teams to request access to.

Charles Ferentchak
  • 1,237
  • 1
  • 9
  • 14
Conner Reeves
  • 1,381
  • 8
  • 13

1 Answers1

1

This was an intentional design decision. We wanted to make sure that the same report would appear the same when viewed by two different people. One of the main enhancements to our previous reporting system was the ability to send someone a link to a report and be assured that the report would be viewed the same by all viewers.

We have added a parameter that will restrict the results to only the snapshots that the user has permissions to see.

If you add &removeUnauthorizedSnapshots=true to the url of the request it will filter out the responses you want without having to provide every single project.

Charles Ferentchak
  • 1,237
  • 1
  • 9
  • 14
  • 1
    Thank you for this Charles! Seems to be working great when adding to requests manually. How can I add this to requests made with the 2.0 SDK though? I added that property to the config, but when I look at the request, it doesn't seem as though it's being passed to the server. Any ideas? – Conner Reeves Aug 19 '13 at 16:33
  • A story about adding "removeUnauthorized" to a Rally.data.lookback.SnapshotStore config is now on a backlog. As a workaround in the meantime I think you can pass params to load: `snapshotStore.load({ params: { compress: true, removeUnauthorizedSnapshots: true }, callback: function(records) { } });` – nickm Aug 27 '13 at 15:11
  • Worked great Nick. Thanks! – Conner Reeves Aug 27 '13 at 16:07
  • This has been working for me, until I tried querying for Tasks. I took an existing query for Initiatives that worked, and changed the TypeHierarchy to Task and it failed to pass the removeUnauthorizedSnapshots parameter - have you run into this? – Tore Sep 03 '13 at 23:50