Bug 1511490 - add Bugzilla method for handling jwts

diff --git a/Bugzilla.pm b/Bugzilla.pm
index d728f91ec577784e2869b1e3913b536b580c677a..d35ede8daef6dfb548f4a46e982fa6e953ac212d 100644 (file)
--- a/Bugzilla.pm
+++ b/Bugzilla.pm
@@ -446,6 +446,12 @@ sub job_queue {
   return request_cache->{job_queue} ||= Bugzilla::JobQueue->new();
 }
 
+sub jwt {
+  my ($class, @args) = @_;
+  require Mojo::JWT;
+  return Mojo::JWT->new(@args, secret => $class->localconfig->{jwt_secret});
+}
+
 sub dbh {
   my ($class) = @_;
 
@@ -1198,4 +1204,11 @@ information.
 
 =back
 
+=item C<jwt>
+
+Returns a L<Mojo::JWT> object, configured with the Bugzilla localconfig jwt_secret set.
+
+  my $payload_hash = Bugzilla->jwt->decode($jwt);
+  my $new_jwt      = Bugzilla->jwt(claims => $payload_hash)->encode;
+
 =back

diff --git a/Bugzilla/Install/Localconfig.pm b/Bugzilla/Install/Localconfig.pm
index 1195c21064f64db0a58b3f4dd65c309b8b1440c7..02c51ec98a587d4956d4c72f2dac7fc869873c38 100644 (file)
--- a/Bugzilla/Install/Localconfig.pm
+++ b/Bugzilla/Install/Localconfig.pm
@@ -80,6 +80,7 @@ use constant LOCALCONFIG_VARS => (
     # is larger than anybody would ever be able to brute-force.
     default => sub { generate_random_password(64) },
   },
+  {name => 'jwt_secret', default => sub { generate_random_password(64) },},
   {
     name    => 'param_override',
     default => {

diff --git a/template/en/default/setup/strings.txt.pl b/template/en/default/setup/strings.txt.pl
index da28cc89cd79551893d76059e4b8e7ad68d5fefc..58c10f5553b28d07da35216cf2319a5e652c2447 100644 (file)
--- a/template/en/default/setup/strings.txt.pl
+++ b/template/en/default/setup/strings.txt.pl
@@ -224,6 +224,10 @@ validation of encrypted tokens. These tokens are used to implement
 security features in Bugzilla, to protect against certain types of attacks.
 A random string is generated by default. It's very important that this key
 is kept secret. It also must be very long.
+END
+  localconfig_jwt_secret => <<'END',
+This secret key is used to generate JWTs. It should be a long unique value.
+It should not be the same as the site_wide_secret.
 END
   localconfig_param_override => <<'END',
 This hash is used by BMO to override select data/params values on a per-webhead