diff --git a/pay-queue/devops/vaults.gcp.env b/pay-queue/devops/vaults.gcp.env index 5bfb8a754..fa6f68780 100644 --- a/pay-queue/devops/vaults.gcp.env +++ b/pay-queue/devops/vaults.gcp.env @@ -19,6 +19,7 @@ PUBLISHER_AUDIENCE="op://gcp-queue/$APP_ENV/base/PUBLISHER_AUDIENCE" PAY_SUB_AUDIENCE="op://gcp-queue/$APP_ENV/base/PAY_SUB_AUDIENCE" VERIFY_PUBSUB_EMAIL="op://gcp-queue/$APP_ENV/base/VERIFY_PUBSUB_EMAIL" VERIFY_PUBSUB_VIA_JWT="op://gcp-queue/$APP_ENV/base/VERIFY_PUBSUB_VIA_JWT" +DEBUG_REQUEST="op://gcp-queue/$APP_ENV/base/DEBUG_REQUEST" ACCOUNT_MAILER_TOPIC="op://gcp-queue/$APP_ENV/topics/ACCOUNT_MAILER_TOPIC" SENTRY_ENABLE="op://sentry/$APP_ENV/relationship-api/SENTRY_ENABLE" SENTRY_DSN="op://sentry/$APP_ENV/relationship-api/SENTRY_DSN" diff --git a/pay-queue/src/pay_queue/config.py b/pay-queue/src/pay_queue/config.py index 2b2a07ab4..cbceb71f4 100644 --- a/pay-queue/src/pay_queue/config.py +++ b/pay-queue/src/pay_queue/config.py @@ -109,7 +109,9 @@ class _Config(): # pylint: disable=too-few-public-methods ACCOUNT_MAILER_TOPIC = os.getenv('ACCOUNT_MAILER_TOPIC', None) PAY_SUB_AUDIENCE = os.getenv('PAY_SUB_AUDIENCE', None) VERIFY_PUBSUB_EMAIL = os.getenv('VERIFY_PUBSUB_EMAIL', None) - VERIFY_PUBSUB_VIA_JWT = os.getenv('VERIFY_PUBSUB_VIA_JWT', None) + + VERIFY_PUBSUB_VIA_JWT = os.getenv('VERIFY_PUBSUB_VIA_JWT', 'true').lower() == 'true' + VERIFY_PUBSUB_VIA_JWT = os.getenv('DEBUG_REQUEST', 'true').lower() == 'true' class DevConfig(_Config): # pylint: disable=too-few-public-methods diff --git a/pay-queue/src/pay_queue/external/gcp_auth.py b/pay-queue/src/pay_queue/external/gcp_auth.py index e6e180f9f..31f575ac6 100644 --- a/pay-queue/src/pay_queue/external/gcp_auth.py +++ b/pay-queue/src/pay_queue/external/gcp_auth.py @@ -35,8 +35,11 @@ def ensure_authorized_queue_user(f): @functools.wraps(f) def decorated_function(*args, **kwargs): # Use CacheControl to avoid re-fetching certificates for every request. - config_value = current_app.config.get('VERIFY_PUBSUB_VIA_JWT', True) - if config_value is True: + if current_app.config.get('DEBUG_REQUEST') is True: + current_app.logger.info(f'Headers: {request.headers}') + verifyJWT = current_app.config.get('VERIFY_PUBSUB_VIA_JWT', True) + current_app.logger.info(f'verifyJWT: {verifyJWT}') + if verifyJWT is True: if message := verify_jwt(CacheControl(Session())): abort(HTTPStatus.UNAUTHORIZED) return f(*args, **kwargs)