feat(integrations): Atlassian Assets connector with service account support#141
Open
joshlemos wants to merge 4 commits intogrcengineering:mainfrom
Open
feat(integrations): Atlassian Assets connector with service account support#141joshlemos wants to merge 4 commits intogrcengineering:mainfrom
joshlemos wants to merge 4 commits intogrcengineering:mainfrom
Conversation
Collaborator
added 4 commits
February 13, 2026 10:49
Phase 1 & 2 implementation of centralized secrets management: - Add Infisical service to dev and prod Docker Compose configs - Add SecretsModule/SecretsService to shared library - Integrate SecretsModule into controls service for credential storage - Add per-service auth modules for frameworks, policies, audit, trust - Add database init scripts for Keycloak and Infisical databases - Fix Keycloak DB URL to use dedicated database instead of app DB - Update startup scripts with Infisical bootstrap secret generation - Add Makefile targets for secrets-ui and secrets-seed - Backward compatible: falls back to env vars when Infisical unavailable
…n UX - Rewrite Atlassian Assets connector with auto-discovery of Cloud ID and Workspace ID from site URL - Add object schema sync support alongside asset objects - Fix integration update mutation to exclude immutable type field - Update frontend config fields with helpful placeholders and descriptions
Atlassian service account API tokens must use the Platform API Gateway
(api.atlassian.com/ex/jira/{cloudId}) rather than the site URL directly.
Regular user API tokens continue to use the site URL.
- Auto-detect service accounts by @serviceaccount.atlassian.com email
- Discover Cloud ID via public /_edge/tenant_info endpoint
- Route all API calls through api.atlassian.com for service accounts
- Provide clear error messages about required token scopes
- Update sync() to use same gateway routing logic
…and Keycloak DB URL Atlassian connector: - Add resolveCredentials() for flat or nested config.credentials - verifyAuth() falls back from /myself to /project for service account scope compat - Treat auth + Jira access as success; Assets is optional (service account CMDB scope limitation) - Sync Jira projects when Assets workspace is unavailable - Flatten nested credentials in integrations.service.ts before validation Keycloak: - Fix KC_DB_URL to use dedicated keycloak database instead of app database
joshlemos
force-pushed
the
feat/atlassian-assets
branch
from
4610f1c to
0169430
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
config.credentialsfor quick-setup compatibility intestConnection()andtriggerSync()api.atlassian.com/ex/jira/{cloudId}gateway with Cloud ID auto-discovery via_edge/tenant_infoContext
Atlassian service account API tokens cannot be granted CMDB/Assets scopes — this is a known platform limitation. Rather than failing, the connector treats auth + Jira access as success and reports Assets as an optional capability. When Assets is unavailable, sync pulls Jira projects (id, key, name, description, type, lead).
The quick-setup flow stores credentials under
config.credentials.{field}but connectors expect flat top-level fields. Added credential flattening in the service layer before validation and connector invocation.Dependencies
Test plan
testConnection()succeeds with valid Atlassian service account credentialstriggerSync()syncs Jira projects when Assets is unavailable