Jira: Add toggle to disable an existing project

[Maffooch]

After a Jira instance has been linked with a Product, it is not possible to unlink the jira instance. While it is possible to set the instance to something different, it is not possible to remove the link altogether

This PR adds a new toggle switch on the jira project form that controls if any new or existing findings can be pushed to jira:

[sc-7825]

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on improving the integration between the Defect Dojo application and Jira, including the addition of an "enabled" field to the Jira project model, enhanced Jira integration testing, robust Jira configuration validation, and secure Jira credential management.

Expand for full summary

Summary:

The code changes in this pull request primarily focus on improving the integration between the Defect Dojo application and Jira. The key changes include:

1. Jira Project Enabled/Disabled: The addition of an "enabled" field to the Jira project model allows users to enable or disable the integration with a specific Jira project. This provides more granular control over the integration and can help mitigate security risks by preventing findings from being pushed to Jira when the integration is not needed.

2. Jira Integration Testing: The changes include updates to the test suite, which add new test cases to validate the behavior of the Jira project integration, including handling cases where the integration is disabled or the Jira project configuration is invalid. This helps ensure the overall security and reliability of the Jira integration functionality.

3. Jira Configuration Validation: The code demonstrates robust validation of the Jira project configuration, ensuring that the integration is properly set up before attempting to create or update Jira issues. This helps prevent potential issues and security vulnerabilities that could arise from improper Jira integration settings.

4. Jira Credential Management: While not directly addressed in the code changes, the secure management of Jira credentials (API keys, tokens, etc.) is an important security consideration for the Jira integration. The application should ensure that these credentials are stored and accessed securely to prevent unauthorized access or misuse.

Overall, the changes in this pull request appear to be focused on improving the security and reliability of the Jira integration within the Defect Dojo application. The addition of the "enabled" field, the enhanced test coverage, and the Jira configuration validation are all positive steps towards maintaining a secure and well-designed application.

Files Changed:

1. dojo/db_migrations/0217_jira_project_enabled.py: This migration adds a new "enabled" field to the "jira_project" model, allowing users to enable or disable the Jira integration for a specific project.

2. dojo/api_v2/views.py: The changes add the "enabled" field to the JiraProjectViewSet, providing a way to control the Jira integration through the API.

3. dojo/jira_link/helper.py: This file contains the core functionality for the Jira integration, including validation, issue management, and error handling. The changes demonstrate a well-designed and comprehensive Jira integration.

4. dojo/forms.py: The changes update the JIRA Project configuration form to handle the new "enabled" field and ensure that the Jira settings are properly inherited from the product.

5. unittests/dojo_test_case.py, unittests/test_jira_config_engagement.py, and unittests/test_jira_config_engagement_epic.py: These files contain updates to the test suite, adding new test cases to validate the Jira project integration functionality, including handling disabled integrations and invalid configurations.

6. dojo/models.py: The changes add the "enabled" field to the JIRA_Project model and update the __str__ method to indicate when the connection is disabled.

Code Analysis

We ran 9 analyzers against 9 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved

[cneill]

Small typo, otherwise looks good 👍