We need to add attachments to a BugzScout submission, and we would like the ability to set other fields too, so we're apparently relegated to the XML API. Which would be fine except that it requires embedding a "token" into our application. At first I was so glad that we don't have to embed our password in the app, but still the "indefinite token hack" is not an acceptable solution because -due to fogbugz permissions as I understand them- I have to give that user (for the token) "modify" permission (which necessarily includes "read" permission) to a FogBugz project in order to be able to submit a case.
That means that anyone with that token (which is everyone now that it is embedded in an app) can use the API to basically read and edit everything in the fogbugz project. With that in mind, we might as well embed the username/password anyway.
So, the questions are:
Is there anyway to configure permissions for my "BugzScout" user to make him only able to submit cases?
Or is there any way to use the XML API anonymously to only be able to submit new BugzScout cases?
Or could you make it so that we can use the XML API with a community user (which does have the possibility of "submit only" permissions) for the XML API in this restricted "BugzScout submission" scenario?