Configure bitbucket plugin to avoid hardcoding of secure variable

Question

I have developed an Atlasian Bitbucket plugin which globally listens for push/PR and send repository details to databases using REST API.

I need to configure REST API URL and credential so that my plugin can make an API call. Currently I have hardcoded REST API URL and credential in my plugin properties file. Which I don't like because every time if I need to create a package to target my test environment or production, I have to change. Also, I don't like to keep credentials in the source code.

What is the best way to add configuration screen in the bitbucket plugin? I would like to have form for URL, username and password (once I installed the plugin) and update the storage in Bitbucket only once. If I need to restart my bitbucket, I do not want to lose saved data.

I tried to search on how to configure a bitbucket plugin, however I could not find an easy way. I do see multiple approaches, for example to add "Configure" button which will open a servelet to take user input. Seems very cryptic to me. Also, I see so many recommendations for template, for example velocity, soy etc which confused me a lot.

Since I am new to plugin development therefore not able to explore. Looking for some help.

Winner 19 · Answer 1 · 2019-03-22T05:01:59.627

I have solution for this case:

From pom.xml please add more library:

<dependency>
    <groupId>com.atlassian.plugins</groupId>
    <artifactId>atlassian-plugins-core</artifactId>
    <version>5.0.0</version>
    <scope>provided</scope>
</dependency>

Create new abc-server.properties on resources/ folder with following content:
```
server.username=YOUR_USERNAME
server.password=YOUR_PASSWORD
```

Get value from abc-server.properties on service class as the following:

import com.atlassian.plugin.util.ClassLoaderUtils;

...

final Properties p = new Properties();
final InputStream is = ClassLoaderUtils.getResourceAsStream("abc-server.properties", this.getClass());

try {
    if (is != null) {
        p.load(is);

        String username = p.getProperty("server.username");
        String password = p.getProperty("server.password");
    }
} catch (IOException e) {
    e.printStackTrace();
}

Please try to implement it. Thanks!

username/password will still be part of code. I do not want to keep it in code. Options could be to use environment variable etc. — joy, Apr 10 '19 at 18:59
@joy you can create new local file with credential info and then read from it. — Winner 19, May 14 '19 at 09:08

score 1 · Answer 2 · answered Sep 13 '19 at 10:18

One possibility for a simple configuration file, is to read somefile.properties from the Bitbucket home directory, this way the config file will survive application updates.

Create somefile.properties in BITBUCKET_HOME

server.username=YOUR_USERNAME
server.password=YOUR_PASSWORD

Read the properties in your plugin class like this

// imports
import com.atlassian.bitbucket.server.StorageService;
import com.atlassian.plugin.spring.scanner.annotation.imports.ComponentImport;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;

private final StorageService storageService;

// StorageService injected via constructor injection
public SomePlugin(@ComponentImport final StorageService storageService) {
        this.storageService = storageService;
}

Properties p = new Properties();

File file = new File(storageService.getHomeDir().toString(), "somefile.properties");
FileInputStream fileInputStream;
try {
    fileInputStream = new FileInputStream(file);
    p.load(fileInputStream);

    String username = p.getProperty("server.username");
    String password = p.getProperty("server.password");

} catch (IOException e) {
    //handle exception
}

Configure bitbucket plugin to avoid hardcoding of secure variable

2 Answers2