diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-10-20 11:43:02 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-10-20 11:43:02 +0300 |
commit | d9ab72d6080f594d0b3cae15f14b3ef2c6c638cb (patch) | |
tree | 2341ef426af70ad1e289c38036737e04b0aa5007 /app/controllers/jira_connect | |
parent | d6e514dd13db8947884cd58fe2a9c2a063400a9b (diff) |
Add latest changes from gitlab-org/gitlab@14-4-stable-eev14.4.0-rc42
Diffstat (limited to 'app/controllers/jira_connect')
-rw-r--r-- | app/controllers/jira_connect/app_descriptor_controller.rb | 1 | ||||
-rw-r--r-- | app/controllers/jira_connect/application_controller.rb | 4 | ||||
-rw-r--r-- | app/controllers/jira_connect/events_controller.rb | 31 |
3 files changed, 31 insertions, 5 deletions
diff --git a/app/controllers/jira_connect/app_descriptor_controller.rb b/app/controllers/jira_connect/app_descriptor_controller.rb index 74fac6ff9bb..e96242c7052 100644 --- a/app/controllers/jira_connect/app_descriptor_controller.rb +++ b/app/controllers/jira_connect/app_descriptor_controller.rb @@ -32,6 +32,7 @@ class JiraConnect::AppDescriptorController < JiraConnect::ApplicationController apiVersion: 1, apiMigrations: { 'context-qsh': true, + 'signed-install': signed_install_active?, gdpr: true } } diff --git a/app/controllers/jira_connect/application_controller.rb b/app/controllers/jira_connect/application_controller.rb index 352e78d6255..ecb23c326fe 100644 --- a/app/controllers/jira_connect/application_controller.rb +++ b/app/controllers/jira_connect/application_controller.rb @@ -74,4 +74,8 @@ class JiraConnect::ApplicationController < ApplicationController params[:jwt] || request.headers['Authorization']&.split(' ', 2)&.last end end + + def signed_install_active? + Feature.enabled?(:jira_connect_asymmetric_jwt) + end end diff --git a/app/controllers/jira_connect/events_controller.rb b/app/controllers/jira_connect/events_controller.rb index fe66e742c44..76ac15f7631 100644 --- a/app/controllers/jira_connect/events_controller.rb +++ b/app/controllers/jira_connect/events_controller.rb @@ -3,13 +3,18 @@ class JiraConnect::EventsController < JiraConnect::ApplicationController # See https://developer.atlassian.com/cloud/jira/software/app-descriptor/#lifecycle - skip_before_action :verify_atlassian_jwt!, only: :installed - before_action :verify_qsh_claim!, only: :uninstalled + skip_before_action :verify_atlassian_jwt! + before_action :verify_asymmetric_atlassian_jwt!, if: :signed_install_active? + + before_action :verify_atlassian_jwt!, only: :uninstalled, unless: :signed_install_active? + before_action :verify_qsh_claim!, only: :uninstalled, unless: :signed_install_active? def installed - return head :ok if atlassian_jwt_valid? + return head :ok if !signed_install_active? && atlassian_jwt_valid? + + return head :ok if current_jira_installation - installation = JiraConnectInstallation.new(install_params) + installation = JiraConnectInstallation.new(event_params) if installation.save head :ok @@ -28,7 +33,23 @@ class JiraConnect::EventsController < JiraConnect::ApplicationController private - def install_params + def event_params params.permit(:clientKey, :sharedSecret, :baseUrl).transform_keys(&:underscore) end + + def verify_asymmetric_atlassian_jwt! + asymmetric_jwt = Atlassian::JiraConnect::AsymmetricJwt.new(auth_token, jwt_verification_claims) + + return head :unauthorized unless asymmetric_jwt.valid? + + @current_jira_installation = JiraConnectInstallation.find_by_client_key(asymmetric_jwt.iss_claim) + end + + def jwt_verification_claims + { + aud: jira_connect_base_url(protocol: 'https'), + iss: event_params[:client_key], + qsh: Atlassian::Jwt.create_query_string_hash(request.url, request.method, jira_connect_base_url) + } + end end |