atlassian-jwt-authentication 0.9.0.pre8 → 0.9.1.pre9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4b613184861f6210fe60369212d95288f3bc85a71a9906714c71d966e1606381
-  data.tar.gz: 320921baeac4b8bdfba96131fcb0a05077242f41e96b7ee3d9e3b03ae5dace01
+  metadata.gz: d4a3c825a4085266a663c307db837c9daf4c12c002c0dc8a31daddfab67993ef
+  data.tar.gz: b342bd603a6a1ab474bea589babfb232b0aeb49486e9df1418151c6675a291e2
 SHA512:
-  metadata.gz: 026ca8a88864fdfa13db84a94d403291ee10935bdcc99a31366a5f93d467479f21c308789f3e06086d206ab4e9656e992431de705095baefbf347d954549717a
-  data.tar.gz: a91c87fe92112b9bef084198e2d2b6aecf82f64e3c881de0448dab04cb463be430993e8a91ead79656f42f97350bdb620778eb8d73c299027bec88f48b7a25e7
+  metadata.gz: f4440680e3c850ec815176ec2d6f29c88d466e53c72a22f85aefb7f0ee86c85505477a84562232ad72fceaf557f46c67a72aefeeeed9f3a2ad0e7e013c195c86
+  data.tar.gz: 496ed5d17f08b4577db4b74a6dac5473807ee250378509a431fd891e0818e26ddc4da3a05f99d3689980105f2efd51aa0b96731cbe5618629ae9a420de7a3a4c

data/README.md

@@ -256,6 +256,12 @@ Config | Environment variable | Description | Default |
 `AtlassianJwtAuthentication.debug_requests` | `AJA_DEBUG_REQUESTS` | when `true` HTTP requests will include body content, implicitly turns on `log_requests` | `false` 
 `AtlassianJwtAuthentication.signed_install` | `AJA_SIGNED_INSTALL` | Installation lifecycle security improvements. Migration process described [here](https://community.developer.atlassian.com/t/action-required-atlassian-connect-installation-lifecycle-security-improvements/49046). In the descriptor set `"apiMigrations":{"signed-install":AtlassianJwtAuthentication.signed_install}`  | `false`
 
+### Middleware configuration
+
+Parameter | Description /
+--------- |-------------|
+`force_asymmetric_verify` | A `proc` expected to return 'true' if the currently processed request must be validated with RS256 algorithm. Used for _signed_install_ endpoints.
+
 ## Requirements
 
 Ruby 2.0+, ActiveRecord 4.1+

data/lib/atlassian-jwt-authentication/filters.rb

@@ -24,17 +24,17 @@ module AtlassianJwtAuthentication
       base_url = params[:baseUrl]
       api_base_url = params[:baseApiUrl] || base_url
 
+      # All install (including upgrades) / uninstall hooks are asymmetrically
+      # signed with RS256 (RSA Signature with SHA-256) algorithm
+      return false unless _verify_jwt(addon_key, force_asymmetric_verify: true)
+
       jwt_auth = JwtToken.where(client_key: client_key, addon_key: addon_key).first
-      if jwt_auth
-        # The add-on was previously installed on this client
-        return false unless _verify_jwt(addon_key)
-        if jwt_auth.id != current_jwt_token.id
-          # Update request was issued to another plugin
-          render_forbidden
-          return false
-        end
-      else
+      if jwt_auth.nil?
         self.current_jwt_token = JwtToken.new(jwt_token_params)
+      elsif jwt_auth.id != current_jwt_token.id
+        # Update request was issued to another plugin
+        render_forbidden
+        return false
       end
 
       current_jwt_token.addon_key = addon_key
@@ -55,7 +55,7 @@ module AtlassianJwtAuthentication
     def on_add_on_uninstalled
       addon_key = params[:key]
 
-      return unless _verify_jwt(addon_key)
+      return unless _verify_jwt(addon_key, force_asymmetric_verify: true)
 
       client_key = params[:clientKey]
 
@@ -67,7 +67,7 @@ module AtlassianJwtAuthentication
     end
 
     def verify_jwt(addon_key, skip_qsh_verification: false)
-      _verify_jwt(addon_key, true, skip_qsh_verification: skip_qsh_verification)
+      _verify_jwt(addon_key, consider_param: true, skip_qsh_verification: skip_qsh_verification)
     end
 
     def ensure_license
@@ -93,7 +93,7 @@ module AtlassianJwtAuthentication
         end
 
         unless response.data['state'] == 'ENABLED' &&
-            response.data['license'] && response.data['license']['active']
+          response.data['license'] && response.data['license']['active']
           log(:error, "client #{current_jwt_token.client_key}: no active & enabled license was found")
           render_payment_required
           return false
@@ -107,7 +107,7 @@ module AtlassianJwtAuthentication
 
     private
 
-    def _verify_jwt(addon_key, consider_param = false, skip_qsh_verification: false)
+    def _verify_jwt(addon_key, consider_param: false, skip_qsh_verification: false, force_asymmetric_verify: false)
       self.current_jwt_token = nil
       self.current_account_id = nil
       self.current_jwt_context = nil
@@ -130,7 +130,7 @@ module AtlassianJwtAuthentication
         jwt = possible_jwt if algorithm == 'JWT'
       end
 
-      jwt_verification = AtlassianJwtAuthentication::JWTVerification.new(addon_key, nil, jwt, request)
+      jwt_verification = AtlassianJwtAuthentication::JWTVerification.new(addon_key, nil, force_asymmetric_verify, jwt, request)
       jwt_verification.exclude_qsh_params = exclude_qsh_params
       jwt_verification.logger = logger if defined?(logger)
 
@@ -150,8 +150,8 @@ module AtlassianJwtAuthentication
 
     def jwt_token_params
       {
-          client_key: params.permit(:clientKey)['clientKey'],
-          addon_key: params.permit(:key)['key']
+        client_key: params.permit(:clientKey)['clientKey'],
+        addon_key: params.permit(:key)['key']
       }
     end
 

data/lib/atlassian-jwt-authentication/middleware.rb

@@ -13,6 +13,7 @@ module AtlassianJwtAuthentication
         @addon_key = options[:addon_key]
         @if = options[:if]
         @audience = options[:audience]
+        @force_asymmetric_verify = options[:force_asymmetric_verify]
       end
 
       def call(env)
@@ -31,7 +32,9 @@ module AtlassianJwtAuthentication
         end
 
         if jwt
-          jwt_verification = JWTVerification.new(@addon_key, @audience, jwt, request)
+          force_asymmetric_verify = @force_asymmetric_verify && @force_asymmetric_verify.call(env)
+
+          jwt_verification = JWTVerification.new(@addon_key, @audience, force_asymmetric_verify, jwt, request)
           jwt_auth, account_id, context, qsh_verified = jwt_verification.verify
 
           if jwt_auth

data/lib/atlassian-jwt-authentication/verify.rb

@@ -2,11 +2,12 @@ require 'jwt'
 
 module AtlassianJwtAuthentication
   class JWTVerification
-    attr_accessor :addon_key, :jwt, :audience, :request, :exclude_qsh_params, :logger
+    attr_accessor :addon_key, :jwt, :audience, :force_asymmetric_verify, :request, :exclude_qsh_params, :logger
 
-    def initialize(addon_key, audience, jwt, request, &block)
+    def initialize(addon_key, audience, force_asymmetric_verify, jwt, request, &block)
       self.addon_key = addon_key
       self.audience = audience
+      self.force_asymmetric_verify = force_asymmetric_verify
       self.jwt = jwt
       self.request = request
 
@@ -39,18 +40,14 @@ module AtlassianJwtAuthentication
           addon_key: addon_key
       ).first
 
-      unless jwt_auth
-        log(:error, "Could not find jwt_token for client_key #{data['iss']} and addon_key #{addon_key}")
-        return false
-      end
-
       # Discard the tokens without verification
       if encoding_data['alg'] == 'none'
         log(:error, "The JWT checking algorithm was set to none for client_key #{data['iss']} and addon_key #{addon_key}")
         return false
       end
 
-      if AtlassianJwtAuthentication.signed_install && encoding_data['alg'] == 'RS256'
+      if force_asymmetric_verify ||
+        AtlassianJwtAuthentication.signed_install && encoding_data['alg'] == 'RS256'
         response = Faraday.get("https://connect-install-keys.atlassian.com/#{encoding_data['kid']}")
         unless response.success? && response.body
           log(:error, "Error retrieving atlassian public key. Response code #{response.status} and kid #{encoding_data['kid']}")
@@ -58,15 +55,24 @@ module AtlassianJwtAuthentication
         end
 
         decode_key = OpenSSL::PKey::RSA.new(response.body)
-        decode_options = {algorithms: ['RS256'], verify_aud: true, aud: audience}
       else
+        unless jwt_auth
+          log(:error, "Could not find jwt_token for client_key #{data['iss']} and addon_key #{addon_key}")
+          return false
+        end
+
         decode_key = jwt_auth.shared_secret
-        decode_options = {}
+      end
+
+      decode_options = {}
+      if encoding_data['alg'] == 'RS256'
+        decode_options = { algorithms: ['RS256'] }
       end
 
       # Decode the token again, this time with signature & claims verification
       options = JWT::DefaultOptions::DEFAULT_OPTIONS.merge(verify_expiration: AtlassianJwtAuthentication.verify_jwt_expiration).merge(decode_options)
       decoder = JWT::Decode.new(jwt, decode_key, true, options)
+
       begin
         payload, header = decoder.decode_segments
       rescue JWT::VerificationError
@@ -85,7 +91,7 @@ module AtlassianJwtAuthentication
       if data['qsh']
         # Verify the query has not been tampered by Creating a Query Hash and
         # comparing it against the qsh claim on the verified token
-        if jwt_auth.base_url.present? && request.url.include?(jwt_auth.base_url)
+        if jwt_auth.present? && jwt_auth.base_url.present? && request.url.include?(jwt_auth.base_url)
           path = request.url.gsub(jwt_auth.base_url, '')
         else
           path = request.path.gsub(AtlassianJwtAuthentication::context_path, '')

data/lib/atlassian-jwt-authentication/version.rb

@@ -1,7 +1,7 @@
 module AtlassianJwtAuthentication
   MAJOR_VERSION = "0"
   MINOR_VERSION = "9"
-  PATH_VERSION = "0"
+  PATCH_VERSION = "1"
 
   # rubygems don't support semantic versioning - https://github.com/rubygems/rubygems/issues/592, using GITHUB_RUN_NUMBER to represent build number
   # going to release pre versions automatically
@@ -12,7 +12,7 @@ module AtlassianJwtAuthentication
       [
         MAJOR_VERSION,
         MINOR_VERSION,
-        PATH_VERSION
+        PATCH_VERSION
       ].join(".") + BUILD_NUMBER
     ).freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: atlassian-jwt-authentication
 version: !ruby/object:Gem::Version
-  version: 0.9.0.pre8
+  version: 0.9.1.pre9
 platform: ruby
 authors:
 - Laura Barladeanu
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-10-16 00:00:00.000000000 Z
+date: 2022-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable