[oauth] add bitbucket connection #49
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| @client_id={{$dotenv BITBUCKET__CLIENT_ID}} | ||
| @client_secret={{$dotenv BITBUCKET__CLIENT_SECRET}} | ||
| @code={{$dotenv BITBUCKET__CODE}} | ||
|
|
||
| ### | ||
| POST https://bitbucket.org/site/oauth2/access_token HTTP/1.1 | ||
| Authorization: Basic {{client_id}}:{{client_secret}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
|
|
||
| grant_type=authorization_code&code={{code}} | ||
|
Comment on lines
+6
to
+10
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf '%s\n' '--- bitbucket.http ---'
cat -n bitbucket.http
printf '%s\n' '--- repository conventions ---'
find /tmp/coderabbit-repo-knowledge/bit-issues-backend-3bf8b929 -maxdepth 2 -type f -name '*.md' -printRepository: bit-issues/backend Length of output: 955 🏁 Script executed: printf '%s\n' '--- repo-wide conventions ---'
cat /tmp/coderabbit-repo-knowledge/bit-issues-backend-3bf8b929/learnings/repo-wide.md
printf '%s\n' '--- related HTTP examples and Basic-auth usage ---'
rg -n -i --glob '*.http' --glob '*.md' --glob '*.json' 'Authorization: Basic|basic auth|base64|oauth2|access_token' .Repository: bit-issues/backend Length of output: 1875 Encode the Basic credentials before this request. After variable substitution, the header sends the raw 🤖 Prompt for AI Agents |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| import { apiRequest } from './client' | ||
| import type { | ||
| BitbucketOAuthAuthorizeResponse, | ||
| BitbucketOAuthStatus, | ||
| } from '$lib/types/api' | ||
|
|
||
| export function getBitbucketOAuthStatus(): Promise<BitbucketOAuthStatus> { | ||
| return apiRequest<BitbucketOAuthStatus>('GET', '/oauth/bitbucket/status') | ||
| } | ||
|
|
||
| export function getBitbucketOAuthAuthorizeUrl(): Promise<BitbucketOAuthAuthorizeResponse> { | ||
| return apiRequest<BitbucketOAuthAuthorizeResponse>( | ||
| 'GET', | ||
| '/oauth/bitbucket/authorize', | ||
| ) | ||
| } | ||
|
|
||
| export function disconnectBitbucketOAuth(): Promise<void> { | ||
| return apiRequest<void>('POST', '/oauth/bitbucket/disconnect') | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,182 @@ | ||
| <script lang="ts"> | ||
| import { Button } from "$lib/components/ui/button"; | ||
| import * as Card from "$lib/components/ui/card"; | ||
| import * as Badge from "$lib/components/ui/badge"; | ||
| import * as Dialog from "$lib/components/ui/dialog"; | ||
| import { | ||
| disconnectBitbucketOAuth, | ||
| getBitbucketOAuthAuthorizeUrl, | ||
| getBitbucketOAuthStatus, | ||
| } from "$lib/api/oauth"; | ||
| import { toast } from "$lib/toast"; | ||
| import type { BitbucketOAuthStatus } from "$lib/types/api"; | ||
|
|
||
| let status = $state<BitbucketOAuthStatus | null>(null); | ||
| let loading = $state(true); | ||
| let loadError = $state(""); | ||
| let busy = $state(false); | ||
| let showDisconnectDialog = $state(false); | ||
|
|
||
| let connected = $derived(status?.connected === true); | ||
| let expired = $derived( | ||
| connected && | ||
| !!status?.expires_at && | ||
| new Date(status.expires_at).getTime() <= Date.now(), | ||
| ); | ||
|
|
||
| let badgeLabel = $derived( | ||
| connected ? (expired ? "Expired/Revoked" : "Connected") : "Disconnected", | ||
| ); | ||
| let badgeColor = $derived( | ||
| connected | ||
| ? expired | ||
| ? "border-transparent bg-red-100 text-red-700 dark:bg-red-300/15 dark:text-red-300" | ||
| : "border-transparent bg-green-100 text-green-700 dark:bg-green-300/15 dark:text-green-300" | ||
| : "border-transparent bg-gray-100 text-gray-600 dark:bg-gray-300/15 dark:text-gray-300", | ||
| ); | ||
|
|
||
| function formatDate(iso?: string): string { | ||
| if (!iso) return "-"; | ||
| const d = new Date(iso); | ||
| return Number.isNaN(d.getTime()) ? iso : d.toLocaleString(); | ||
| } | ||
|
|
||
| function loadStatus() { | ||
| loading = true; | ||
| loadError = ""; | ||
| getBitbucketOAuthStatus() | ||
| .then((res) => { | ||
| status = res; | ||
| }) | ||
| .catch((e: Error) => { | ||
| status = null; | ||
| loadError = e?.message || "Failed to load Bitbucket connection status"; | ||
| }) | ||
| .finally(() => { | ||
| loading = false; | ||
| }); | ||
| } | ||
|
|
||
| $effect(loadStatus); | ||
|
|
||
| async function handleConnect() { | ||
| if (busy) return; | ||
| busy = true; | ||
| try { | ||
| const { url } = await getBitbucketOAuthAuthorizeUrl(); | ||
| window.location.assign(url); | ||
| } catch (e: any) { | ||
| toast.error(e?.message || "Failed to start Bitbucket connection"); | ||
| busy = false; | ||
| } | ||
| } | ||
|
|
||
| async function handleDisconnect() { | ||
| if (busy) return; | ||
| busy = true; | ||
| try { | ||
| await disconnectBitbucketOAuth(); | ||
| status = { connected: false }; | ||
| showDisconnectDialog = false; | ||
| toast.success("Disconnected from Bitbucket"); | ||
| } catch (e: any) { | ||
| toast.error(e?.message || "Failed to disconnect from Bitbucket"); | ||
| } finally { | ||
| busy = false; | ||
| } | ||
| } | ||
| </script> | ||
|
|
||
| <Card.Root> | ||
| <Card.CardHeader> | ||
| <div class="flex items-center justify-between gap-2"> | ||
| <Card.CardTitle>Bitbucket OAuth</Card.CardTitle> | ||
| {#if status} | ||
| <Badge.Root class={badgeColor}>{badgeLabel}</Badge.Root> | ||
| {/if} | ||
| </div> | ||
| </Card.CardHeader> | ||
| <Card.CardContent> | ||
| {#if loading} | ||
| <p class="text-muted-foreground text-sm">Loading...</p> | ||
| {:else if loadError} | ||
| <p class="text-destructive text-sm">{loadError}</p> | ||
| {:else if status} | ||
| <div class="flex flex-col gap-2"> | ||
| <p class="text-muted-foreground text-sm"> | ||
| {#if connected} | ||
| Webhook registration uses the connected Bitbucket app. | ||
| {:else} | ||
| Connect a Bitbucket app to manage repository webhooks. | ||
| {/if} | ||
| </p> | ||
| {#if connected} | ||
| <div class="flex flex-col gap-1"> | ||
| <span class="text-muted-foreground text-xs font-medium"> | ||
| Connected At | ||
| </span> | ||
| <span class="text-sm">{formatDate(status.connected_at)}</span> | ||
| </div> | ||
| <div class="flex flex-col gap-1"> | ||
| <span class="text-muted-foreground text-xs font-medium"> | ||
| Token Expires At | ||
| </span> | ||
| <span class="text-sm">{formatDate(status.expires_at)}</span> | ||
| </div> | ||
| {#if status.scopes?.length} | ||
| <div class="flex flex-col gap-1"> | ||
| <span class="text-muted-foreground text-xs font-medium"> | ||
| Scopes | ||
| </span> | ||
| <span class="text-sm">{status.scopes.join(", ")}</span> | ||
| </div> | ||
| {/if} | ||
| {/if} | ||
| </div> | ||
| {/if} | ||
| </Card.CardContent> | ||
| {#if !loading && (status || loadError)} | ||
| <Card.CardFooter class="justify-end gap-2"> | ||
| {#if loadError && !status} | ||
| <Button size="sm" variant="outline" onclick={loadStatus}>Retry</Button> | ||
| {/if} | ||
| {#if status} | ||
| {#if !connected || expired} | ||
| <Button size="sm" disabled={busy} onclick={handleConnect}> | ||
| {busy ? "..." : "Connect with Bitbucket"} | ||
| </Button> | ||
| {/if} | ||
| {#if connected} | ||
| <Button | ||
| size="sm" | ||
| variant="destructive" | ||
| disabled={busy} | ||
| onclick={() => (showDisconnectDialog = true)} | ||
| > | ||
| Disconnect | ||
| </Button> | ||
| {/if} | ||
| {/if} | ||
| </Card.CardFooter> | ||
| {/if} | ||
| </Card.Root> | ||
|
|
||
| <Dialog.Root | ||
| bind:open={showDisconnectDialog} | ||
| title="Disconnect from Bitbucket?" | ||
| description="Remove the stored Bitbucket OAuth connection?" | ||
| > | ||
| <p class="text-muted-foreground text-sm"> | ||
| Active repository webhooks will stop delivering push events after the | ||
| Bitbucket token expires (about 2 hours). No remote webhooks are removed | ||
| automatically. | ||
| </p> | ||
| {#snippet footer()} | ||
| <Button variant="ghost" onclick={() => (showDisconnectDialog = false)}> | ||
| Cancel | ||
| </Button> | ||
| <Button variant="destructive" onclick={handleDisconnect} disabled={busy}> | ||
| {busy ? "Disconnecting..." : "Disconnect"} | ||
| </Button> | ||
| {/snippet} | ||
| </Dialog.Root> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,47 @@ | ||
| <script lang="ts"> | ||
| import { onMount } from "svelte"; | ||
| import BitbucketOAuthCard from "$lib/components/BitbucketOAuthCard.svelte"; | ||
| import { toast } from "$lib/toast"; | ||
|
|
||
| const OAUTH_ERROR_MESSAGES: Record<string, string> = { | ||
| access_denied: "Bitbucket authorization was denied", | ||
| missing_params: "The Bitbucket callback was missing required parameters", | ||
| exchange_failed: "Bitbucket rejected the authorization code", | ||
| invalid_state: "The connection session expired or was already used. Try again.", | ||
| }; | ||
|
|
||
| onMount(() => { | ||
| // The Bitbucket OAuth callback redirects to /#/admin?oauth=success|error. | ||
| // With the hash router the result lives in the fragment, so read it from | ||
| // window.location.hash (falling back to search for robustness). | ||
| const hashQuery = window.location.hash.split("?")[1] ?? ""; | ||
| const params = new URLSearchParams(hashQuery || window.location.search); | ||
| const outcome = params.get("oauth"); | ||
| if (outcome === "success") { | ||
| toast.success("Connected to Bitbucket"); | ||
| } else if (outcome === "error") { | ||
| const reason = params.get("reason") ?? ""; | ||
| toast.error( | ||
| OAUTH_ERROR_MESSAGES[reason] ?? "Failed to connect to Bitbucket", | ||
| ); | ||
| } else { | ||
| return; | ||
| } | ||
| const route = window.location.hash.slice(1).split("?")[0] || "/admin"; | ||
| window.history.replaceState( | ||
| null, | ||
| "", | ||
| window.location.pathname + window.location.search + "#" + route, | ||
| ); | ||
|
Comment on lines
+30
to
+35
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Remove consumed OAuth parameters from the fallback query string. When the callback uses 🤖 Prompt for AI Agents |
||
| }); | ||
| </script> | ||
|
|
||
| <div class="flex flex-col gap-4 p-6"> | ||
| <div> | ||
| <h1 class="text-2xl font-bold">Settings</h1> | ||
| <p class="text-muted-foreground text-sm"> | ||
| Manage integrations and workspace settings | ||
| </p> | ||
| </div> | ||
| <BitbucketOAuthCard /> | ||
| </div> | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
Repository: bit-issues/backend
Length of output: 9124
Sensitive Data Exposure (CWE-312): Cleartext Storage of Sensitive Information
Reachability: Internal · Exploitability: Difficult
Do not persist OAuth tokens in plaintext.
The OAuth repository writes access and refresh tokens directly to
oauth_tokens. Encrypt both values before persistence, and keep the encryption key outside the database.🤖 Prompt for AI Agents