<commit_before>module AtlassianJwtAuthentication
  module Filters
    protected

    def on_add_on_installed
      # Add-on key that was installed into the Atlassian Product, as it appears in your add-on's descriptor.
      addon_key = params[:key]

      # Identifying key for the Atlassian product instance that the add-on was installed into.
      # This will never change for a given instance, and is unique across all Atlassian product tenants.
      # This value should be used to key tenant details in your add-on
      client_key = params[:clientKey]

      # Use this string to sign outgoing JWT tokens and validate incoming JWT tokens
      shared_secret = params[:sharedSecret]

      # Identifies the category of Atlassian product, e.g. jira or confluence.
      product_type = params[:productType]

      @jwt_auth = JwtToken.where(client_key: client_key).first
      @jwt_auth = JwtToken.new(client_key: client_key) unless @jwt_auth

      @jwt_auth.addon_key = addon_key
      @jwt_auth.shared_secret = shared_secret
      @jwt_auth.product_type = "atlassian:#{product_type}"

      @jwt_auth.save!
    end

    def on_add_on_uninstalled
      return false unless params[:clientKey].present?

      @jwt_auth = JwtToken.where(client_key: params[:clientKey]).first
      @jwt_auth.destroy if @jwt_auth
    end

    def verify_jwt
      jwt = nil
      jwt = params[:jwt] if params[:jwt].present?

      if request.headers['authorization'].present?
        algorithm, jwt = request.headers['authorization'].split(' ')
        jwt = nil unless algorithm == 'JWT'
      end

      unless jwt.present?
        render(nothing: true, status: :unauthorized)
        return false
      end

      # Decode the JWT parameter without verification
      decoded = JWT.decode(jwt, nil, false)

      # Extract the data
      data = decoded[0]
      encoding_data = decoded[1]

      # Find a matching JWT token in the DB
      @jwt_auth = JwtToken.where(
          client_key: data['iss']
      ).first

      unless @jwt_auth
        render(nothing: true, status: :unauthorized)
        return false
      end

      # Discard tokens without verification
      if encoding_data['alg'] == 'none'
        render(nothing: true, status: :unauthorized)
        return false
      end

      # Verify the signature with the sharedSecret and the algorithm specified in the header's alg field
      header, payload, signature, signing_input = JWT.decoded_segments(jwt)
      unless header && payload
        render(nothing: true, status: :unauthorized)
        return false
      end

      begin
        JWT.verify_signature(encoding_data['alg'], @jwt_auth.shared_secret, signing_input, signature)
      rescue Exception => e
        render(nothing: true, status: :unauthorized)
        return false
      end

      # Has this user accessed our add-on before?
      # If not, create a new JwtUser
      @user_context = data['context']['user']

      # Is this an Atlassian user we haven't seen before?
      @jwt_user = @jwt_auth.jwt_users.where(user_key: @user_context['userKey']).first
      @jwt_user = JwtUser.create(jwt_token_id: @jwt_auth.id, user_key: @user_context['userKey']) unless @jwt_user

      # Everything's alright
      true
    end
  end
end<commit_msg>Require the add-on key in verify_jwt<commit_after>module AtlassianJwtAuthentication
  module Filters
    protected

    def on_add_on_installed
      # Add-on key that was installed into the Atlassian Product, as it appears in your add-on's descriptor.
      addon_key = params[:key]

      # Identifying key for the Atlassian product instance that the add-on was installed into.
      # This will never change for a given instance, and is unique across all Atlassian product tenants.
      # This value should be used to key tenant details in your add-on
      client_key = params[:clientKey]

      # Use this string to sign outgoing JWT tokens and validate incoming JWT tokens
      shared_secret = params[:sharedSecret]

      # Identifies the category of Atlassian product, e.g. jira or confluence.
      product_type = params[:productType]

      @jwt_auth = JwtToken.where(client_key: client_key, addon_key: addon_key).first
      @jwt_auth = JwtToken.new(client_key: client_key, addon_key: addon_key) unless @jwt_auth

      @jwt_auth.addon_key = addon_key
      @jwt_auth.shared_secret = shared_secret
      @jwt_auth.product_type = "atlassian:#{product_type}"

      @jwt_auth.save!
    end

    def on_add_on_uninstalled
      return false unless params[:clientKey].present?

      @jwt_auth = JwtToken.where(client_key: params[:clientKey]).first
      @jwt_auth.destroy if @jwt_auth
    end

    def verify_jwt(addon_key)
      unless addon_key
        render(nothing: true, status: :unauthorized)
        return false
      end

      jwt = nil
      jwt = params[:jwt] if params[:jwt].present?

      if request.headers['authorization'].present?
        algorithm, jwt = request.headers['authorization'].split(' ')
        jwt = nil unless algorithm == 'JWT'
      end

      unless jwt.present?
        render(nothing: true, status: :unauthorized)
        return false
      end

      # Decode the JWT parameter without verification
      decoded = JWT.decode(jwt, nil, false)

      # Extract the data
      data = decoded[0]
      encoding_data = decoded[1]

      # Find a matching JWT token in the DB
      @jwt_auth = JwtToken.where(
          client_key: data['iss'],
          addon_key: addon_key
      ).first

      unless @jwt_auth
        render(nothing: true, status: :unauthorized)
        return false
      end

      # Discard tokens without verification
      if encoding_data['alg'] == 'none'
        render(nothing: true, status: :unauthorized)
        return false
      end

      # Verify the signature with the sharedSecret and the algorithm specified in the header's alg field
      header, payload, signature, signing_input = JWT.decoded_segments(jwt)
      unless header && payload
        render(nothing: true, status: :unauthorized)
        return false
      end

      begin
        JWT.verify_signature(encoding_data['alg'], @jwt_auth.shared_secret, signing_input, signature)
      rescue Exception => e
        render(nothing: true, status: :unauthorized)
        return false
      end

      # Has this user accessed our add-on before?
      # If not, create a new JwtUser
      @user_context = data['context']['user']

      # Is this an Atlassian user we haven't seen before?
      @jwt_user = @jwt_auth.jwt_users.where(user_key: @user_context['userKey']).first
      @jwt_user = JwtUser.create(jwt_token_id: @jwt_auth.id, user_key: @user_context['userKey']) unless @jwt_user

      # Everything's alright
      true
    end
  end
end
{'fraction_non_alphanumeric': 0.08096506808762581, 'fraction_numerical': 0.0005920663114268798, 'mean_word_length': 2.811054709531867, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '122546', 'n_tokens_mistral': 2046, 'n_tokens_neox': 1965, 'n_words': 599}