Introduce concern for resetting secret fields
What does this MR do and why?
We want to force users to re-enter secret fields when changing certain other fields (such as URLs), which can unintentionally expose the secret fields.
This adds a new concern to handle this logic, and sets it up in the Jira integration. In future MRs we also want to reuse this concern for other integrations which currently duplicate this logic.
Exposing fields can be marked with the exposing_secrets: flag in
the Field DSL.
The Jira integration also had some custom logic where the url field
was only considered if the api_url was blank, but to generalize this
we're now resetting the secrets if either of the URL fields has changed.
Issue: #344099 (closed)
How to set up and validate locally
- Open a project.
- Navigate to Settings -> Integrations -> Jira.
- Enable the
Activecheckbox. - Enter
http://example.cominWeb URL. - Enter an email address in
Username or Email. - Enter any value in
Password or API token.
- Enable the
- Click
Save changes-> Form should be saved without errors. - Test that passwords are not reset when not necessary:
- Click
Save changeswithout changing any fields -> Form should be saved without errors. - Enter any value for
Password or API tokenand clickSave changes-> Form should be saved without errors.
- Click
- Test that passwords are reset when necessary:
- Change
Web URLand clickSave changes-> Form should show errors for thePassword or API tokenfield. - Enter a valid URL in
Jira API URLand clickSave changes-> Form should show errors for thePassword or API tokenfield.
- Change
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Related to #344099 (closed)