Add authentication via JWT to CustomersDot internal API

What does this MR do and why?

Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/466368+

Add authentication via JWT to the GitLabSubscriptions internal API.

We want to be able to authenticate CustomersDot with JWT tokens, fetching the public key from CDot itself. This is an initial implementation. We only have one endpoint configured to send this type of token, and it's disabled behind a feature flag current.

This will be followed up by an MR to:

  1. Introduce caching of the configuration and JWKs
  2. Migrate the CustomersDot endpoints not in the internal API namespaces to this auth method

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

Start CustomersDot and the GDK.

  1. CustomersDot: Enable the use_jwt_auth_for_internal_api_call FF

  2. CustomersDot: Start a rails console, and query the GitLab User (this is the only migrated endpoint currently)

    irb(main):001> Gitlab::User.new(Order.last.customer.uid).username
    => "july-2024"
  3. CustomersDot: Check that using also admin-token works as expected

    [2] pry(main)> Client::GitlabApp.get("/api/v4/internal/gitlab_subscriptions/namespaces/1", { token: Client::GitlabApp::ADMIN_API_TOKEN })
    => {"id"=>1,
     "name"=>"Administrator",
     "path"=>"root",
     "kind"=>"user",
     "full_path"=>"root",
      ....}
  4. GDK: Checkout master and try again (it should fail as the auth is not implemented)

    irb(main):002> Gitlab::User.new(Order.last.customer.uid).username
    => nil
Edited by Bishwa Hang Rai

Merge request reports

Loading