diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-05-19 10:33:21 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-05-19 10:33:21 +0300 |
commit | 36a59d088eca61b834191dacea009677a96c052f (patch) | |
tree | e4f33972dab5d8ef79e3944a9f403035fceea43f /app/controllers/jira_connect | |
parent | a1761f15ec2cae7c7f7bbda39a75494add0dfd6f (diff) |
Add latest changes from gitlab-org/gitlab@15-0-stable-eev15.0.0-rc42
Diffstat (limited to 'app/controllers/jira_connect')
-rw-r--r-- | app/controllers/jira_connect/application_controller.rb | 40 | ||||
-rw-r--r-- | app/controllers/jira_connect/events_controller.rb | 2 | ||||
-rw-r--r-- | app/controllers/jira_connect/subscriptions_controller.rb | 3 |
3 files changed, 15 insertions, 30 deletions
diff --git a/app/controllers/jira_connect/application_controller.rb b/app/controllers/jira_connect/application_controller.rb index 9b3bff062dd..e26d69314cd 100644 --- a/app/controllers/jira_connect/application_controller.rb +++ b/app/controllers/jira_connect/application_controller.rb @@ -20,60 +20,44 @@ class JiraConnect::ApplicationController < ApplicationController end def verify_qsh_claim! - payload, _ = decode_auth_token! - - return if request.format.json? && payload['qsh'] == 'context-qsh' + return if request.format.json? && jwt.verify_context_qsh_claim # Make sure `qsh` claim matches the current request - render_403 unless payload['qsh'] == Atlassian::Jwt.create_query_string_hash(request.url, request.method, jira_connect_base_url) - rescue StandardError - render_403 + render_403 unless jwt.verify_qsh_claim(request.url, request.method, jira_connect_base_url) end def atlassian_jwt_valid? return false unless installation_from_jwt # Verify JWT signature with our stored `shared_secret` - decode_auth_token! - rescue JWT::DecodeError - false + jwt.valid?(installation_from_jwt.shared_secret) end def installation_from_jwt strong_memoize(:installation_from_jwt) do - next unless claims['iss'] + next unless jwt.iss_claim - JiraConnectInstallation.find_by_client_key(claims['iss']) - end - end - - def claims - strong_memoize(:claims) do - next {} unless auth_token - - # Decode without verification to get `client_key` in `iss` - payload, _ = Atlassian::Jwt.decode(auth_token, nil, false) - payload + JiraConnectInstallation.find_by_client_key(jwt.iss_claim) end end def jira_user strong_memoize(:jira_user) do next unless installation_from_jwt - next unless claims['sub'] + next unless jwt.sub_claim # This only works for Jira Cloud installations. - installation_from_jwt.client.user_info(claims['sub']) + installation_from_jwt.client.user_info(jwt.sub_claim) end end - def decode_auth_token! - Atlassian::Jwt.decode(auth_token, installation_from_jwt.shared_secret) + def jwt + strong_memoize(:jwt) do + Atlassian::JiraConnect::Jwt::Symmetric.new(auth_token) + end end def auth_token - strong_memoize(:auth_token) do - params[:jwt] || request.headers['Authorization']&.split(' ', 2)&.last - end + params[:jwt] || request.headers['Authorization']&.split(' ', 2)&.last end end diff --git a/app/controllers/jira_connect/events_controller.rb b/app/controllers/jira_connect/events_controller.rb index 3c78f63e069..394fdc9b2f6 100644 --- a/app/controllers/jira_connect/events_controller.rb +++ b/app/controllers/jira_connect/events_controller.rb @@ -47,7 +47,7 @@ class JiraConnect::EventsController < JiraConnect::ApplicationController end def verify_asymmetric_atlassian_jwt! - asymmetric_jwt = Atlassian::JiraConnect::AsymmetricJwt.new(auth_token, jwt_verification_claims) + asymmetric_jwt = Atlassian::JiraConnect::Jwt::Asymmetric.new(auth_token, jwt_verification_claims) return head :unauthorized unless asymmetric_jwt.valid? diff --git a/app/controllers/jira_connect/subscriptions_controller.rb b/app/controllers/jira_connect/subscriptions_controller.rb index d8ce67d6267..2ba9f8264e1 100644 --- a/app/controllers/jira_connect/subscriptions_controller.rb +++ b/app/controllers/jira_connect/subscriptions_controller.rb @@ -19,7 +19,8 @@ class JiraConnect::SubscriptionsController < JiraConnect::ApplicationController end before_action do - push_frontend_feature_flag(:jira_connect_oauth, @user, default_enabled: :yaml) + push_frontend_feature_flag(:jira_connect_oauth, @user) + push_frontend_feature_flag(:jira_connect_oauth_self_managed, @user) end before_action :allow_rendering_in_iframe, only: :index |