Add API authentication and panic handling in server webhook process

[Kshitij-Katiyar]

Summary

Add API authentication and panic handling in the server webhook process

Ticket Link

Fixes https://mattermost.atlassian.net/browse/MM-64153
Fixes https://mattermost.atlassian.net/browse/MM-64148

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull Request Overview

This pull request enhances API security and server robustness by adding authentication checks to endpoints and improving error handling in JSON deserialization for Confluence webhooks.

• Update function signature of ConfluenceServerEventFromJSON to return errors.
• Add IsAuthenticated flags for multiple endpoints.
• Introduce a new checkAuth middleware in the controller for secured endpoints.

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
server/serializer/confluence_server.go	Updated JSON deserialization to return errors in case of failure.
server/save_subscription.go	Added IsAuthenticated flag for API authentication.
server/oauth2.go	Updated IsAuthenticated flags for OAuth endpoints.
server/get_subscriptions.go	Enabled API authentication on subscriptions endpoint.
server/get_subscription.go	Enabled API authentication on subscription retrieval endpoint.
server/edit_subscription.go	Enabled API authentication on subscription edit endpoint.
server/controller.go	Introduced checkAuth middleware and incorporated it into API routing.
server/confluence_server.go	Modified webhook handler for proper error handling of JSON payloads.
server/confluence_cloud.go	Enabled IsAuthenticated flag on Confluence cloud webhook endpoint.
server/atlassian_connect.go	Set IsAuthenticated flag for Atlassian connect endpoint.

[Copilot]

Pull Request Overview

This PR implements API authentication and panic handling in the server webhook process. Key changes include:

• Updating header retrieval to use a constant (config.HeaderMattermostUserID) for consistent authentication.
• Adding the IsAuthenticated flag on various endpoints to enforce authentication where required.
• Enhancing error handling in the Confluence server webhook payload decoding.

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
server/user.go	Updated header retrieval for user identification in OAuth endpoints.
server/serializer/confluence_server.go	Enhanced JSON decoding to return errors for invalid payloads.
server/save_subscription.go	Marked subscription saving endpoint as authenticated.
server/oauth2.go	Marked OAuth2 endpoints as authenticated.
server/get_subscriptions.go	Updated header retrieval and marked autocomplete subscriptions endpoint as authenticated.
server/get_subscription.go	Marked subscription retrieval endpoint as authenticated.
server/edit_subscription.go	Marked subscription editing endpoint as authenticated.
server/controller.go	Added auth middleware to endpoints; potential duplicate route registration noted.
server/confluence_server.go	Improved webhook error handling on JSON unmarshal failure.
server/confluence_cloud.go	Explicitly set authentication flag to false.
server/atlassian_connect.go	Explicitly set authentication flag to false.

[wiggin77]

LGTM 👍

[Kshitij-Katiyar]

@enzowritescode Fixed the comments

[Kshitij-Katiyar]

fixed the comment @enzowritescode