Fix #635: ignore update workflow when project does not match config (#636)

Author: leplatrem

jbi/runner.py

@@ -202,13 +202,23 @@ def execute_action(
 
         else:
             # Check that issue exists (and is readable)
-            if not jira.get_service().get_issue(
+            jira_issue = jira.get_service().get_issue(
                 action_context, action_context.jira.issue
-            ):
+            )
+            if not jira_issue:
                 raise IgnoreInvalidRequestError(
                     f"ignore unreadable issue {action_context.jira.issue}"
                 )
 
+            # Make sure that associated project in configuration matches the
+            # project of the linked Jira issue (see #635)
+            if (
+                project_key := jira_issue["fields"]["project"]["key"]
+            ) != action_context.jira.project:
+                raise IgnoreInvalidRequestError(
+                    f"ignore linked project {project_key!r} (!={action_context.jira.project!r})"
+                )
+
             if event.target == "bug":
                 action_context = action_context.update(
                     operation=Operation.UPDATE,

tests/unit/test_runner.py

@@ -33,14 +33,15 @@ def webhook_comment_example(
 
 
 def test_bugzilla_object_is_always_fetched(
-    mocked_bugzilla, webhook_create_example, actions_factory, bug_factory
+    mocked_jira, mocked_bugzilla, webhook_create_example, actions_factory, bug_factory
 ):
     # See https://github.com/mozilla/jira-bugzilla-integration/issues/292
     fetched_bug = bug_factory(
         id=webhook_create_example.bug.id,
         see_also=[f"{get_settings().jira_base_url}browse/JBI-234"],
     )
     mocked_bugzilla.get_bug.return_value = fetched_bug
+    mocked_jira.get_issue.return_value = {"fields": {"project": {"key": "JBI"}}}
 
     execute_action(
         request=webhook_create_example,
@@ -50,6 +51,30 @@ def test_bugzilla_object_is_always_fetched(
     mocked_bugzilla.get_bug.assert_called_once_with(webhook_create_example.bug.id)
 
 
+def test_request_is_ignored_because_project_mismatch(
+    webhook_create_example: BugzillaWebhookRequest,
+    actions_factory,
+    mocked_jira,
+    mocked_bugzilla,
+    bug_factory,
+):
+    bug = bug_factory(
+        id=webhook_create_example.bug.id,
+        see_also=[f"{get_settings().jira_base_url}browse/JBI-234"],
+    )
+    webhook_create_example.bug = bug
+    mocked_bugzilla.get_bug.return_value = bug
+    mocked_jira.get_issue.return_value = {"fields": {"project": {"key": "FXDROID"}}}
+
+    with pytest.raises(IgnoreInvalidRequestError) as exc_info:
+        execute_action(
+            request=webhook_create_example,
+            actions=actions_factory(),
+        )
+
+    assert str(exc_info.value) == "ignore linked project 'FXDROID' (!='JBI')"
+
+
 def test_request_is_ignored_because_private(
     webhook_create_example: BugzillaWebhookRequest,
     actions_factory,