# Administration

> Who may use Oktul Code Studio, the site settings, the console's administration sections, spaces, and exporting and importing the whole configuration.
>
> Documentation for Oktul Code Studio, for Jira Cloud and Confluence Cloud, by Oktul: https://oktul.com/docs/plugins/code-studio/configure/

Administrators configure Code Studio in two places. The **console** carries everything that starts
a script or that a script reaches, in a rail of sections beside the scripts. The **administration
page** keeps the site's settings and import and export.

| Where | What |
|---|---|
| The console's rail | Scripts; Run: listeners, schedules, API triggers, the audit log; Fields: scripted fields, dynamic forms; Reach: connections, variables. **Ctrl+K** (or Cmd+K) outside the editor searches them all |
| The administration page, **Site settings** at the foot of the rail | Who may use the console, runs, hosts scripts may call directly, import and export |

## Who may do what

"Administrator" means an administrator of the app's **required** product, wherever the console is
opened: Jira's administrators in the Jira listing, Confluence's in the Confluence listing. The role
is asked of the product on every call and never taken from the browser.

| Action | Who |
|---|---|
| Read scripts and runs, edit drafts, run in the sandbox | Administrators, and members of the developer groups |
| Publish a script, run in production, change listeners, schedules, API triggers, connections, variables, repositories and settings, allow a script for automation rules, import and export | Administrators |
| Run a published script in production from the console, as themselves, in a space they may edit | Developers, only with **Allow developers to run code in production** on |
| Run a script from a Jira automation rule | Whoever may edit the rule, for the scripts and modes an administrator allowed for rules |

## Site settings

| Setting | Default | What it does |
|---|---|---|
| **Developer groups** | None | Members may write scripts and run them in the sandbox. Groups are stored by id, so renaming a group grants nothing |
| **Allow developers to run code in production** | Off | A developer may run a published script in production from the console, as themselves, in a space they may edit |
| **Days a run, its log and its changes are kept** | 10 | 1 to 90. Runs expire after it |
| **Pause a listener or schedule after this many failed production runs in a row** | 1 | Paused until its script runs successfully in the console. 0 never pauses |
| **Let administrators run unsaved console code in production** | Off | Off, production runs only published revisions |
| **Hosts scripts may call directly** | None | A script may fetch an approved host with no credentials. Each is approved in Atlassian's own dialog. The five hosts the app declares are listed as **Always allowed** |

## Spaces

A space is a top-level folder with its own viewers and editors, by Jira group or by person.

- **Administrators** see every space.
- **A developer sees** a space whose viewers or editors are empty or name them or their group, and
  **edits** one whose editors do.
- **The server decides** on every console call and Rovo action. A space the caller cannot see
  answers as missing.
- **Scripts from before spaces** are under **Outside every space**, open to every role.

A space can be kept in step with a repository: see [scripts](../scripts/#repositories).

## Import and export

**Export as zip** writes every script as its own file at its path, and every space, listener,
schedule, API trigger, connection, scripted field and setting as its own JSON file. Secrets are
included only sealed with a passphrase, in an AES-256-GCM envelope with a key derived by scrypt;
without one they are left out.

**Import** adds what the file holds with the ids it had, so automation rules naming a script keep
working. Nothing already there is replaced: the whole file is refused if an id, a connection key, a
variable name or a script name is taken. Every listener, schedule, API trigger and connection
arrives **off and awaiting review**, and production refuses an imported script until an
administrator publishes it here. Hosts are approved again, because an approval belongs to the site
that gave it. AssemblyScript modules are compiled again in the console. A file is held to 4
million characters, and a zip to 10,000 files and 64 MB unpacked.

<Aside type="note" title="Scripted fields travel too">
An import creates scripted fields in Jira only when the person importing administers Jira; the
answer says what was left out otherwise.
</Aside>

## The audit log

**Audit log**, under Run in the rail, lists runs with filters, and what administrators changed.
Runs and their logs are kept for the retention set above. Secret values never appear in it.

## Related

- [Install the app](../install/)
- [Connections and variables](../connections-and-variables/)
- [Security](../security/)

---

A problem or a question? Write to [support@oktul.com](mailto:support@oktul.com) or open a request in the [Help Center](https://oktul.atlassian.net/servicedesk/customer/portals). Both open a request with a reference and an SLA.