Plan — BJ-7: JiraAdapter + webhook route#

Summary#

Add a JiraAdapter that normalizes Jira webhooks into DispatchEvent, expose POST /webhooks/jira, and extract HMAC-SHA256 into a shared helper so both adapters share one crypto path. Targets rc/atlassian-integration (Wave 2).

Files#

Path	Action	Notes
`src/webhook/crypto.ts`	create	`verifyHmacSha256(rawBody, signatureHeader, secret, prefix)` — timingSafeEqual, throws `UnauthorizedException`
`src/webhook/adapters/github.adapter.ts`	modify	Replace inline HMAC block (lines 30–45) with `verifyHmacSha256(..., 'sha256=')`
`src/webhook/adapters/github.adapter.spec.ts`	modify	Keep existing coverage; no behavioural change
`src/webhook/adapters/jira.adapter.ts`	create	Implements `PlatformAdapter` (`platform='jira'`); switches on `body.webhookEvent`
`src/webhook/adapters/jira.adapter.spec.ts`	create	Covers 5 event types + signature + unknown-event ignore
`src/webhook/webhook.controller.ts`	modify	Add `@Post('jira')` handler mirroring `handleGitHub` shape, reads `JIRA_WEBHOOK_SECRET`, signature header `x-hub-signature`
`src/webhook/webhook.controller.spec.ts`	modify	Add cases: 401 on bad signature, 200 + dispatch on valid payload, 200 + ignored on unknown event
`src/webhook/webhook.module.ts`	modify	Provide `JiraAdapter`; register in `onModuleInit()`
`src/webhook/dto/dispatch-event.dto.ts`	modify	Add `'issue_updated'` and `'link_created'` to `DispatchEventType`; add `'jira'` to `platform` union (coordinate with #540)
`src/config/config.schema.ts`	modify	`JIRA_WEBHOOK_SECRET: Joi.string().optional()`
`.env.example`	modify	Document `JIRA_WEBHOOK_SECRET`
`CLAUDE.md`	modify	Note `JIRA_WEBHOOK_SECRET` in env-var table

Steps#

Extract verifyHmacSha256 into src/webhook/crypto.ts and refactor GitHubAdapter.verifySignature to delegate.
Extend DispatchEventType with issue_updated and link_created; add 'jira' to the platform union; update .env.example, config.schema.ts, and CLAUDE.md for JIRA_WEBHOOK_SECRET.
Implement JiraAdapter with the 5 event mappings (jira:issue_created→intake, jira:issue_updated→issue_updated with changelog inspection, jira:issue_deleted→task_cancelled, comment_created|comment_updated→issue_comment, jira:issuelink_created→link_created); unknown event returns { event: null, reason }.
Add POST /webhooks/jira to WebhookController: read raw body, call adapter.verifySignature with header x-hub-signature and JIRA_WEBHOOK_SECRET, persist WebhookDeliveryEntity with source='jira', resolve tenant via TenantResolverService.resolveFromWebhook('jira', ...), dispatch.
Register JiraAdapter in WebhookModule providers and onModuleInit().
Write jira.adapter.spec.ts (event mapping, signature, graceful unknown) and extend webhook.controller.spec.ts with jira-route coverage; run npm run test and npm run lint.

Verification#

npm run test passes; new specs cover all 5 event types plus bad/missing signature and unknown webhookEvent.
npm run lint passes with zero warnings; npm run build succeeds.
GitHubAdapter behaviour unchanged — its existing spec continues to pass after crypto extraction.

Risks#

#540 (BJ-0) not yet merged — it also adds 'jira' to platform unions. Mitigation: include the union extension here if rc/atlassian-integration still lacks it at implementation time; rebase drops the duplicate once #540 lands.
Tenant resolution for Jira — TenantResolverService.resolveFromWebhook may not yet support 'jira'. Mitigation: fall back to { org: <configured>, source: 'jira' } and open a follow-up if the resolver needs Jira-specific logic.

Open Questions#

Should jira:issue_updated without a changelog field emit an issue_updated dispatch, or be ignored? Plan assumes emit (carry commentBody=undefined, no label info) per the issue's "graceful" guidance.