Skip to content

Bugzilla webhook authorization - #6786

Open
ayoubdiourin7 wants to merge 2 commits into
mozilla:masterfrom
ayoubdiourin7:bugzilla-webhook-authorization
Open

Bugzilla webhook authorization#6786
ayoubdiourin7 wants to merge 2 commits into
mozilla:masterfrom
ayoubdiourin7:bugzilla-webhook-authorization

Conversation

@ayoubdiourin7

Copy link
Copy Markdown
Contributor

Fixes #6755

@ayoubdiourin7
ayoubdiourin7 requested a review from a team as a code owner September 4, 2026 12:47
Comment thread docs/hackbot/triggers.md
Comment on lines +145 to 148
- An unauthorized request is ignored without
consuming the dedupe key, leaving the same flag eligible for a later delivery after the
requester becomes authorized.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is implementation details that are not needed in the docs.

Comment thread docs/hackbot/triggers.md
Comment on lines -157 to +163
Configuration is three env vars — `BUGZILLA_WEBHOOK_SECRET` (required, no default),
`BUGZILLA_WEBHOOK_BOT_LOGIN` and `BUGZILLA_WEBHOOK_DEDUPE_TTL_SECONDS`; see
[deployment.md](deployment.md).
Configuration is four env vars — `BUGZILLA_WEBHOOK_SECRET` (required, no default),
`BUGZILLA_WEBHOOK_BOT_LOGIN`, `BUGZILLA_WEBHOOK_URL` and
`BUGZILLA_WEBHOOK_DEDUPE_TTL_SECONDS`; see [deployment.md](deployment.md).

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we do not even need this.

_REQUEST_TIMEOUT_SECONDS = 30


class BugzillaUserClient:

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It should be BugzillaClient, similer to PhabricatorClient. We have an issue to resolve that in /libs: #6307

As a temporary solution, you move this logic to BugzillaAuthorizer, and add a TODO comment to mention #6459.

Comment on lines +41 to +42
# Bugzilla instance queried to authorize the requesting user.
url: str = "https://bugzilla.mozilla.org"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does not fit here. You could add it on the main Settings class as bugzilla_api_url. You can add bugzilla_api_key as well.

bug_id: int
flag_id: int
comment: str
actor_login: str

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what not calling it user_login to match Bugzilla?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bugzilla webhook should not respond to users without editbug permissions

2 participants