Problem

An external approver (Email step) has no decision buttons in the email. The link in the email opens the approval page, which requires an account and login. The first notification creates an account and sends an activation email; until the approver activates it, the "Action required" emails of further Email steps are not delivered to them (reminders are). A person outside the company who does not want to create an account cannot decide and blocks the approval.

Atlassian users already have "Enable actions without login": they decide with one click on a button in the email, without logging in, through a link valid for 24 hours.

Change

• A new global setting in the "Actions in notifications" section, "Enable actions without login for external approvers", separate from "Enable actions without login", enables decisions without login for external approvers. Like "Enable actions without login", it is shown only while "Enable action buttons in notifications" is on, and it has no effect while that setting is off. Off by default. It carries the "New" badge.

• When it is on, these emails to an external approver contain decision buttons as for Atlassian users: Approve and Reject (or Consent), and Abstain when enabled, with the note that the links are valid for 24 hours:

  • the "Action required" email;

  • automatic and custom reminders (fresh buttons in each one; an address with two waiting Email steps gets a reminder email per step);

  • the "Step reassigned" email sent to the new address when the email address of an active Email step is changed.

• The external approver "Action required" template gets a new variable ${actionButtons} that places the buttons. The default Jira and Confluence templates contain it; a saved template without it gets the buttons at the end. The Messages page lists the variable and its preview shows the buttons. With the setting off, the variable renders as nothing.

• A click opens the same confirmation page as for Atlassian users: the approver confirms, with a comment when the decision requires one. Nothing is recorded by opening the link. The decision is recorded without login and without an account, on the approver's Email step, and Activity shows it for their email address "via email link".

• After 24 hours, or when the setting has been turned off since the email was sent, a click leads to the approval page in the external approver portal. An approver who is not logged in goes through login, "Create account" (activating the account logs them in), "Send me login link" or "Forgot Password" first, and then lands on that approval with "You chose Approve in the email. Confirm it with the button below." The chosen button is focused and the comment box is open when the decision requires a comment. Nothing is recorded until they click.

• The account and the activation email are created as today, but notifications and reminders are also delivered to external approvers without an activated account.

Fixes included

• Jira: the "Step reassigned" and "removed from step" emails to an Email step's addresses no longer carry buttons and pending-approvals links that open Jira, which an external approver cannot use. They point to the external approver portal, as reminders already do.

• External approver portal: after logging in from an approval link, the approver lands on that approval (or the requested list) instead of always on "Awaiting"; a failed login, "Create account", the activation email, "Send me login link" and "Forgot Password" keep that target; activating an account logs the person in; an already logged-in user opening the login page with a target goes straight to it.

• External approver portal: a decision that requires a comment can no longer be submitted without one; the check in the browser never ran.

• External approver portal: the 8-character password minimum of account activation and password reset is also checked on the server; the password reset form now asks for 8 characters too.

• A link stays valid when another step of the approval changes (for example another Email step's address is changed): it decides on the approver's current Email step of that approval.

• Changing the email address of an active Email step to an address without an Approval Path account creates the account and sends the activation email, as starting an Email step does.

Out of scope

• Vote steps.

• Decision links generated through the REST API (they still require login).

• Changes to the existing "Enable actions without login" for Atlassian users.

• Activation, login link and password emails sent from the portal pages keep the Jira name in Confluence, as today (AP-2536).

• No-login links of Atlassian users and Slack buttons after a new version of the approval (AP-2535).

Acceptance criteria

• With the setting on, an external approver without an account makes a decision from the "Action required" email or a reminder without logging in; the approval history shows the decision for their email address.

• The link does not work and shows a message when the step is no longer active, the approval is completed or archived, the approver has already decided, or the email address in the step was changed to another one.

• When the decision requires a comment, it cannot be submitted without a comment.

• After 24 hours the link leads to login or registration; after logging in, or after activating a new account, the approver lands on that approval with the chosen decision.

• An external approver without an activated account receives further notifications and reminders, and receives the activation email only once.

• The new setting can be turned on only when "Enable action buttons in notifications" is on.

• With the setting off, emails to external approvers, accounts and login work as today, apart from the fixes listed above.

Manual tester notes

• Settings > Notifications > "Actions in notifications": the new toggle shows only while "Enable action buttons in notifications" is on, has the "New" badge, and survives a reload after saving.

• Start an approval with an Email step for an address that has no account. The address gets the activation email and the "Action required" email with Approve and Reject (Consent on a consent step, Abstain when enabled) and the 24 hours note. Approve from the email in a private browser window: the confirmation page opens, Confirm records the decision, and Activity shows it for the email address "via email link".

• Same with a definition that requires a comment on reject: the confirmation page does not submit without a comment.

• Start a second approval for the same address without activating the account: the "Action required" email arrives, and no second activation email.

• Automatic reminder and custom reminder (also from Rovo) to that address carry fresh buttons. With two Email steps for the same address waiting in parallel, a custom reminder sends one email per step, each deciding its own step.

• Change the address of an active Email step: the new address gets "Step reassigned" with buttons; the old address's buttons show that the email address was changed. On an approval with two Email steps, change one address and check that the other approver's existing buttons still work.

• Turn the setting off and click a button from an earlier email: it opens the approval portal with the chosen decision (after login). Turn "Enable action buttons in notifications" off: same.

• Expired link: wait 24 hours after the email, click Approve: login page; log in (also try "Create account", where activating logs you in, "Send me login link" and "Forgot Password"), then the approval shows "You chose Approve in the email" with Approve focused. On the confirmation page opened just before expiry, Confirm after expiry shows "Open the approval".

• Messages page: the "Action required" external approver template lists ${actionButtons}; the preview shows the buttons only while both settings are on; a saved template without the variable gets the buttons at the end of the email.

• Click the link after the approval is completed, archived, or the step was decided: a message, no decision.

• Jira, action buttons on and the new setting off: change an Email step's address; the "Step reassigned" email to the new address has no buttons and its links open the external approver portal.

• Both products: run the main checks in Jira and in Confluence (direct email mechanism).