-
Notifications
You must be signed in to change notification settings - Fork 16
Add Github controller and jwt helper #66
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,56 @@ | ||
package com.org.jenkins.custom.jenkins.distribution.service; | ||
|
||
import java.util.List; | ||
import org.kohsuke.github.GHApp; | ||
import org.kohsuke.github.GHAppInstallation; | ||
import org.kohsuke.github.GHAppInstallationToken; | ||
import org.kohsuke.github.GitHub; | ||
import org.kohsuke.github.GitHubBuilder; | ||
import org.springframework.beans.factory.annotation.Autowired; | ||
import org.springframework.beans.factory.annotation.Value; | ||
import org.springframework.core.env.Environment; | ||
import org.springframework.web.bind.annotation.CrossOrigin; | ||
import org.springframework.web.bind.annotation.PostMapping; | ||
import org.springframework.web.bind.annotation.RequestBody; | ||
import org.springframework.web.bind.annotation.RestController; | ||
|
||
import static com.org.jenkins.custom.jenkins.distribution.service.GithubJwtHelper.createJWT; | ||
import static com.org.jenkins.custom.jenkins.distribution.service.GithubJwtHelper.get; | ||
|
||
|
||
@RestController | ||
@CrossOrigin("*") | ||
public class GithubController { | ||
|
||
@Value("${APP_IDENTIFIER}") | ||
private String getAppIdentifier; | ||
|
||
@PostMapping(path = "/event_handler") | ||
public void handleEvent(@RequestBody String requestBodyString) throws Exception { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Same comment as the other pull-request, please use javadoc to document methods. |
||
System.out.println("Received event handler event"); | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Should the logger be used here instead of There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Oh yeah my bad :( |
||
String token = authenticateApplication(); | ||
System.out.println(token); | ||
} | ||
|
||
@SuppressWarnings("deprecation") | ||
private String authenticateApplication() { | ||
try { | ||
String APP_IDENTIFIER = getAppIdentifier.replaceAll("^\"+|\"+$", ""); | ||
String jwtToken = createJWT(APP_IDENTIFIER, 600000); | ||
GitHub gitHubApp = new GitHubBuilder().withEndpoint("https://api.github.com").withJwtToken(jwtToken).build(); | ||
GHApp app = gitHubApp.getApp(); | ||
List<GHAppInstallation> appInstallations = app.listInstallations().asList(); | ||
if (!appInstallations.isEmpty()) { | ||
GHAppInstallation appInstallation = appInstallations.get(0); | ||
GHAppInstallationToken appInstallationToken = appInstallation | ||
.createToken(appInstallation.getPermissions()) | ||
.create(); | ||
return appInstallationToken.getToken(); | ||
} | ||
} catch (Exception e) { | ||
e.printStackTrace(); | ||
} | ||
return null; | ||
} | ||
|
||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,50 @@ | ||
package com.org.jenkins.custom.jenkins.distribution.service; | ||
|
||
import io.jsonwebtoken.JwtBuilder; | ||
import io.jsonwebtoken.SignatureAlgorithm; | ||
import io.jsonwebtoken.Jwts; | ||
import java.io.File; | ||
import java.security.Key; | ||
import java.security.KeyFactory; | ||
import java.security.PrivateKey; | ||
import java.security.spec.PKCS8EncodedKeySpec; | ||
import java.util.Date; | ||
import com.google.common.io.Files; | ||
|
||
|
||
public class GithubJwtHelper { | ||
|
||
static PrivateKey get(String filename) throws Exception { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Correct me if I am wrong. I think this method 1) encodes the key, then 2) it encrypts it. Is that right? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Absolutely :) There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Ok, then this explanation can be put in the javadoc. |
||
byte[] keyBytes = Files.toByteArray(new File(filename)); | ||
PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes); | ||
KeyFactory kf = KeyFactory.getInstance("RSA"); | ||
return kf.generatePrivate(spec); | ||
} | ||
|
||
static String createJWT(String githubAppId, long ttlMillis) throws Exception { | ||
//The JWT signature algorithm we will be using to sign the token | ||
SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.RS256; | ||
|
||
long nowMillis = System.currentTimeMillis(); | ||
Date now = new Date(nowMillis); | ||
|
||
//We will sign our JWT with our private key | ||
Key signingKey = get("jenkins-custom-distribution-bot.der"); | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Is this private key the same for all users of the application? Excuse my ignorance, but where does this key come from? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This private key comes from the private key of the bot that one creates on github, so when you create an application on github you get a private key for that bot, which you can then sign and verify yourself There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Is the private key stored in the |
||
|
||
//Let's set the JWT Claims | ||
JwtBuilder builder = Jwts.builder() | ||
.setIssuedAt(now) | ||
.setIssuer(githubAppId) | ||
.signWith(signingKey, signatureAlgorithm); | ||
|
||
//if it has been specified, let's add the expiration | ||
if (ttlMillis > 0) { | ||
long expMillis = nowMillis + ttlMillis; | ||
Date exp = new Date(expMillis); | ||
builder.setExpiration(exp); | ||
} | ||
|
||
//Builds the JWT and serializes it to a compact, URL-safe string | ||
return builder.compact(); | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1 +1 @@ | ||
|
||
APP_IDENTIFIER = "71744" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The value is read from the properties file. Does the user need to change this value when they run the application?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If this is hosted no, if it is self-hosted then yes
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the case where it is self-hosted, the user needs a way to change the
APP_IDENTIFIER
value then. I would recommend finding a way to read this value from an environment variable, or a user provided properties file, without having the user change the source code of the application.