Merge branch 'feature/PB-44058_JWT-keys-are-not-created-on-Docker-due-to-undefined-and-unnecessary-env-var' into 'master'

PB-44058 - Update JWT key function to create JWT by default following API changes

See merge request passbolt/passbolt_docker!232

Author: dlen

scripts/entrypoint/passbolt/entrypoint-openshift.sh

@@ -83,11 +83,21 @@ function migrate_command() {
 }
 
 function jwt_keys_creation() {
-  if [[ $PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED == "true" && (! -f $passbolt_config/jwt/jwt.key || ! -f $passbolt_config/jwt/jwt.pem) ]]; then
+  if [[ "${PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED}" == "false" ]]; then
+    return 0
+  fi
+
+  if [[ ! -f "$passbolt_config/jwt/jwt.key" || ! -f "$passbolt_config/jwt/jwt.pem" ]]; then
+    mkdir -p "$passbolt_config/jwt"
+    chmod 770 "$passbolt_config/jwt"
+
     /usr/share/php/passbolt/bin/cake passbolt create_jwt_keys
-    chmod 440 "$passbolt_config/jwt/jwt.key" && chown www-data:0 "$passbolt_config/jwt/jwt.key"
-    chmod 440 "$passbolt_config/jwt/jwt.pem" && chown www-data:0 "$passbolt_config/jwt/jwt.pem"
-    chmod 550 "$passbolt_config/jwt"
+
+    chmod 640 "$passbolt_config/jwt/jwt.key"
+    chown www-data:0 "$passbolt_config/jwt/jwt.key"
+    chmod 640 "$passbolt_config/jwt/jwt.pem"
+    chown www-data:0 "$passbolt_config/jwt/jwt.pem"
+    chmod 750 "$passbolt_config/jwt"
   fi
 }
 

scripts/entrypoint/passbolt/entrypoint-rootless.sh

@@ -83,11 +83,19 @@ function migrate_command() {
 }
 
 function jwt_keys_creation() {
-  if [[ $PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED == "true" && (! -f $passbolt_config/jwt/jwt.key || ! -f $passbolt_config/jwt/jwt.pem) ]]; then
+  if [[ "${PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED}" == "false" ]]; then
+    return 0
+  fi
+
+  if [[ ! -f "$passbolt_config/jwt/jwt.key" || ! -f "$passbolt_config/jwt/jwt.pem" ]]; then
+    mkdir -p "$passbolt_config/jwt"
+    chmod 770 "$passbolt_config/jwt"
+
     /usr/share/php/passbolt/bin/cake passbolt create_jwt_keys
-    chmod 440 "$passbolt_config/jwt/jwt.key" && chown www-data:www-data "$passbolt_config/jwt/jwt.key"
-    chmod 440 "$passbolt_config/jwt/jwt.pem" && chown www-data:www-data "$passbolt_config/jwt/jwt.pem"
-    chmod 550 "$passbolt_config/jwt"
+
+    chmod 640 "$passbolt_config/jwt/jwt.key"
+    chmod 640 "$passbolt_config/jwt/jwt.pem"
+    chmod 750 "$passbolt_config/jwt"
   fi
 }
 

scripts/entrypoint/passbolt/entrypoint.sh

@@ -85,12 +85,22 @@ function migrate_command() {
 }
 
 function jwt_keys_creation() {
-  if [[ $PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED == "true" && (! -f $passbolt_config/jwt/jwt.key || ! -f $passbolt_config/jwt/jwt.pem) ]]; then
+  if [[ "${PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED}" == "false" ]]; then
+    return 0
+  fi
+
+  if [[ ! -f "$passbolt_config/jwt/jwt.key" || ! -f "$passbolt_config/jwt/jwt.pem" ]]; then
+    mkdir -p "$passbolt_config/jwt"
     chmod 770 "$passbolt_config/jwt"
+    chown www-data:www-data "$passbolt_config/jwt"
     su -c '/usr/share/php/passbolt/bin/cake passbolt create_jwt_keys' -s /bin/bash www-data
-    chmod 440 "$passbolt_config/jwt/jwt.key" && chown root:www-data "$passbolt_config/jwt/jwt.key"
-    chmod 440 "$passbolt_config/jwt/jwt.pem" && chown root:www-data "$passbolt_config/jwt/jwt.pem"
-    chmod 550 "$passbolt_config/jwt"
+  fi
+
+  if [[ -f "$passbolt_config/jwt/jwt.key" && -f "$passbolt_config/jwt/jwt.pem" ]]; then
+    chmod 640 "$passbolt_config/jwt/jwt.key"
+    chmod 640 "$passbolt_config/jwt/jwt.pem"
+    chmod 750 "$passbolt_config/jwt"
+    chown -Rf root:www-data "$passbolt_config/jwt"
   fi
 }
 

scripts/entrypoint/passbolt/env.sh

@@ -60,8 +60,7 @@
       'DATASOURCES_DEFAULT_PASSWORD=±!@#$%^&*()_+=-}{|:;<>?',
       'DATASOURCES_DEFAULT_USERNAME=passbolt',
       'DATASOURCES_DEFAULT_DATABASE=passbolt',
-      'PASSBOLT_SSL_FORCE=true',
-      'PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED=true'
+      'PASSBOLT_SSL_FORCE=true'
     ]
     container_env = @container_env.clone
 
@@ -399,22 +398,22 @@
   describe 'jwt configuration' do
     it 'should have the correct permissions' do
       expect(file(jwt_conf)).to be_a_directory
-      expect(file(jwt_conf)).to be_mode 550
+      expect(file(jwt_conf)).to be_mode 750
       expect(file(jwt_conf)).to be_owned_by($root_user)
       expect(file(jwt_conf)).to be_grouped_into($config_group)
     end
 
     describe 'JWT key file' do
       it 'should exist' do
         expect(file("#{jwt_conf}/jwt.key")).to exist
-        expect(file("#{jwt_conf}/jwt.key")).to be_mode 440
+        expect(file("#{jwt_conf}/jwt.key")).to be_mode 640
       end
     end
 
     describe 'JWT pem file' do
       it 'should exist' do
         expect(file("#{jwt_conf}/jwt.pem")).to exist
-        expect(file("#{jwt_conf}/jwt.pem")).to be_mode 440
+        expect(file("#{jwt_conf}/jwt.pem")).to be_mode 640
       end
     end
   end