Introduce concern for resetting secret fields
What does this MR do and why?
We want to force users to re-enter secret fields when changing certain other fields (such as URLs), which can unintentionally expose the secret fields.
This adds a new concern to handle this logic, and sets it up in the Jira integration. In future MRs we also want to reuse this concern for other integrations which currently duplicate this logic.
Exposing fields can be marked with the exposing_secrets:
flag in
the Field DSL.
The Jira integration also had some custom logic where the url
field
was only considered if the api_url
was blank, but to generalize this
we're now resetting the secrets if either of the URL fields has changed.
Issue: #344099 (closed)
How to set up and validate locally
- Open a project.
- Navigate to Settings -> Integrations -> Jira.
- Enable the
Active
checkbox. - Enter
http://example.com
inWeb URL
. - Enter an email address in
Username or Email
. - Enter any value in
Password or API token
.
- Enable the
- Click
Save changes
-> Form should be saved without errors. - Test that passwords are not reset when not necessary:
- Click
Save changes
without changing any fields -> Form should be saved without errors. - Enter any value for
Password or API token
and clickSave changes
-> Form should be saved without errors.
- Click
- Test that passwords are reset when necessary:
- Change
Web URL
and clickSave changes
-> Form should show errors for thePassword or API token
field. - Enter a valid URL in
Jira API URL
and clickSave changes
-> Form should show errors for thePassword or API token
field.
- Change
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Related to #344099 (closed)